package rest

import (
	"net/http"

	"goAuth/internal/cors"
	"goAuth/internal/csrf"
	"goAuth/internal/middleware"
)

func (h *Handler) registerRoutes(mux *http.ServeMux) {
	corsMw := cors.NewMiddleware(h.cfg.Cors.Origins, h.cfg.Cors.Methods, h.cfg.Cors.Headers)
	csrfMw := csrf.NewMiddleware(h.cfg.Cookies.CsrfName, "csrf", h.cfg.Cookies.Secure)
	sessionMw := h.sessionMiddleware()

	publicChain := middleware.MiddlewareChain{corsMw, csrfMw}
	userChain := middleware.MiddlewareChain{corsMw, csrfMw, sessionMw}
	superuserChain := middleware.MiddlewareChain{corsMw, csrfMw, sessionMw, h.superuser}

	mux.Handle("POST /api/auth/signup", publicChain.ThenFunc(h.signup))
	mux.Handle("POST /api/auth/signin", publicChain.ThenFunc(h.signin))
	mux.Handle("POST /api/auth/signout", userChain.ThenFunc(h.signout))

	mux.Handle("GET /api/profile", userChain.ThenFunc(h.getProfile))
	mux.Handle("PATCH /api/profile", userChain.ThenFunc(h.updateProfile))
	mux.Handle("PUT /api/profile", userChain.ThenFunc(h.updateProfile))
	mux.Handle("PUT /api/profile/password", userChain.ThenFunc(h.updatePassword))
	mux.Handle("POST /api/profile/avatar", userChain.ThenFunc(h.uploadAvatar))
	mux.Handle("PUT /api/profile/avatar", userChain.ThenFunc(h.uploadAvatar))
	mux.Handle("GET /api/profile/avatar", userChain.ThenFunc(h.getAvatar))

	mux.Handle("GET /api/sessions", userChain.ThenFunc(h.listSessions))
	mux.Handle("DELETE /api/sessions", userChain.ThenFunc(h.signoutAll))
	mux.Handle("DELETE /api/sessions/{token}", userChain.ThenFunc(h.signoutSession))

	mux.Handle("GET /api/invites", superuserChain.ThenFunc(h.listInvites))
	mux.Handle("POST /api/invites", superuserChain.ThenFunc(h.createInvite))
	mux.Handle("GET /api/invites/{token}", superuserChain.ThenFunc(h.getInvite))
	mux.Handle("DELETE /api/invites/{token}", superuserChain.ThenFunc(h.deleteInvite))

	// Public avatar route: the Jitsi server fetches this directly, so it must
	// not require a session cookie (CORS middleware only, no session check).
	mux.Handle("GET /api/users/{id}/avatar", publicChain.ThenFunc(h.getUserAvatar))

	mux.Handle("GET /api/users", superuserChain.ThenFunc(h.listUsers))
	mux.Handle("PUT /api/users/{id}/password", superuserChain.ThenFunc(h.changeUserPassword))
	mux.Handle("DELETE /api/users/{id}/sessions", superuserChain.ThenFunc(h.signoutUserSessions))

	mux.Handle("GET /api/jitsi/rooms", userChain.ThenFunc(h.listRecentRooms))
	mux.Handle("POST /api/jitsi/rooms", userChain.ThenFunc(h.joinRoom))
	mux.Handle("DELETE /api/jitsi/rooms/{room}", userChain.ThenFunc(h.deleteRecentRoom))
}