import { Router } from 'express';
import rateLimit from 'express-rate-limit';
import { signup, login, logout, me, updateMe, uploadAvatar, removeAvatar, changePassword, refresh } from '../controllers/auth.controller.js';
import { imageUpload } from '../middlewares/upload.js';
import verifyFirebaseToken from '../middlewares/verifyFirebaseToken.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import validate from '../middlewares/validate.js';
import { signupSchema, loginSchema, refreshSchema, updateProfileSchema, changePasswordSchema } from '../validators/auth.validator.js';
import { errorResponse } from '../utils/response.js';
import { env } from '../config/env.js';

const router = Router();

// Tighter than the general /api/v1 limiter: signup/login are exactly the
// endpoints a credential-stuffing or brute-force attempt would hit.
const authLimiter = rateLimit({
  windowMs: env.AUTH_RATE_LIMIT_WINDOW_MS,
  max: env.AUTH_RATE_LIMIT_MAX,
  standardHeaders: true,
  legacyHeaders: false,
  handler: (_req, res) => void errorResponse(res, 'Too many attempts, please try again later', 429),
});

router.post('/signup', authLimiter, validate(signupSchema), signup);
router.all('/signup', methodNotAllowed('POST'));

router.post('/login', authLimiter, validate(loginSchema), login);
router.all('/login', methodNotAllowed('POST'));

router.post('/refresh', authLimiter, validate(refreshSchema), refresh);
router.all('/refresh', methodNotAllowed('POST'));

router.get('/me', verifyFirebaseToken, me);
// My profile: people edit their own name, phone and job title.
router.patch('/me', verifyFirebaseToken, validate(updateProfileSchema), updateMe);
router.all('/me', methodNotAllowed('GET', 'PATCH'));
// Profile photo (multipart `file`: JPG, PNG, WebP or SVG up to 5 MB), stored in S3.
router.post('/me/avatar', verifyFirebaseToken, imageUpload, uploadAvatar);
router.delete('/me/avatar', verifyFirebaseToken, removeAvatar);
router.all('/me/avatar', methodNotAllowed('POST', 'DELETE'));

// Rate-limited like login: it checks a password.
router.post('/change-password', authLimiter, verifyFirebaseToken, validate(changePasswordSchema), changePassword);
router.all('/change-password', methodNotAllowed('POST'));

router.post('/logout', verifyFirebaseToken, logout);
router.all('/logout', methodNotAllowed('POST'));

export default router;