package router

import (
	"bookhoard/internal/handlers"

	"github.com/labstack/echo/v5"
)

func registerAuthRoutes(cfg *Config, rateLimitMiddleware echo.MiddlewareFunc) {
	e := cfg.Echo

	// Auth routes (no auth required, but rate limited)
	e.POST("/api/auth/register", rateLimitMiddleware(cfg.AuthHandler.Register))
	e.POST("/api/auth/login", rateLimitMiddleware(cfg.AuthHandler.Login))

	// JWT middleware for protected routes
	jwtMiddleware := createJWTMiddleware(cfg)

	// Create protected route group
	protected := e.Group("/api", jwtMiddleware)

	// Protected auth routes
	protected.GET("/auth/profile", cfg.AuthHandler.GetProfile)

	// Refresh token endpoint (no authentication required - uses refresh token from body)
	e.POST("/api/auth/refresh", cfg.AuthHandler.RefreshAccessToken)

	// Logout endpoint (optional authentication - can revoke tokens if provided)
	e.POST("/api/auth/logout", cfg.AuthHandler.Logout)

	// Auth update routes
	authGroup := e.Group("/api/auth", createJWTMiddleware(cfg))
	authGroup.PUT("/password", cfg.AuthHandler.UpdatePassword)
	authGroup.PUT("/theme", cfg.AuthHandler.UpdateTheme)

	// Profile management (combined handlers - self-edit)
	authGroup.PUT("/profile", cfg.AuthHandler.UpdateProfile)
	authGroup.DELETE("/profile", cfg.AuthHandler.DeleteUser)

	// Admin-only routes (same handlers with URL param)
	admin := protected.Group("/auth", handlers.AdminMiddleware)
	admin.GET("/users", cfg.AuthHandler.ListUsers)
	admin.PUT("/users/:id/max-devices", cfg.AuthHandler.UpdateUserMaxDevices)
	admin.PUT("/profile/:id", cfg.AuthHandler.UpdateProfile)
	admin.PUT("/password/:id", cfg.AuthHandler.UpdatePassword)
	admin.DELETE("/profile/:id", cfg.AuthHandler.DeleteUser)
}