export default defineEventHandler(async (event) => {
  const config = useRuntimeConfig(event)
  const body = await readBody(event)

  if (!body?.refreshToken) {
    throw createError({ statusCode: 400, statusMessage: 'Missing refresh token' })
  }

  const tokenUrl = `${config.public.keycloakUrl}/realms/${config.public.keycloakRealm}/protocol/openid-connect/token`

  const params = new URLSearchParams({
    grant_type: 'refresh_token',
    client_id: config.public.keycloakClientId,
    client_secret: config.keycloakClientSecret,
    refresh_token: body.refreshToken
  })

  try {
    const response = await $fetch(tokenUrl, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: params.toString()
    })

    return response
  } catch (error: any) {
    throw createError({
      statusCode: error.response?.status || 401,
      statusMessage: 'Refresh token invalid or expired'
    })
  }
})