/**
 * Tenant auth router — foundation-auth-rbac (Tasks 12 & 14) + auth-2fa (Tasks 6, 7, 8).
 *
 * Public routes (no session required): signup, login, verify-email, refresh
 * (refresh cookie IS the credential), forgot/reset-password, invite accept.
 *
 * 2FA bypass routes (session required but 2FA not yet verified):
 *   - enroll/start, enroll/verify (BYPASS_2FA_GUARD)
 *   - 2fa/verify, 2fa/backup-code (consume pending tokens, no session needed)
 *
 * Protected routes (behind authMiddleware + require2FAIfEnforced):
 *   logout, me, switch-tenant, invite create, trusted-devices, backup-codes/regenerate,
 *   DELETE /2fa, security-settings (+ requirePermission)
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { require2FAIfEnforced } from '@zync/auth'
import { signupRoute } from './signup'
import { loginRoute } from './login'
import { verifyEmailRoute } from './verify-email'
import { refreshRoute } from './refresh'
import { passwordRoute } from './password'
import { logoutRoute } from './logout'
import { meRoute } from './me'
import { switchTenantRoute } from './switch-tenant'
import { inviteAcceptRoute, inviteCreateRoute } from './invite'
import { twoFactorVerifyRoute } from './2fa-verify'
import { twoFactorEnrollPublicRoute, twoFactorEnrollRoute } from './2fa-enroll'
import { securitySettingsRoute } from './security-settings'
import { trustedDevicesRoute } from './trusted-devices'
import { membershipsRoute } from './memberships'

const authRoutes = new Hono<AppEnv>()

// --- Public (no session; each applies its own Origin check) ---
authRoutes.route('/', signupRoute)
authRoutes.route('/', loginRoute)
authRoutes.route('/', verifyEmailRoute)
authRoutes.route('/', refreshRoute)
authRoutes.route('/', passwordRoute)
authRoutes.route('/', inviteAcceptRoute)

// --- 2FA verify/backup-code + public enroll (no authMiddleware; self-auth via pending tokens) ---
// twoFactorVerifyRoute:       2fa/verify, 2fa/backup-code  — pending_2fa token
// twoFactorEnrollPublicRoute: 2fa/enroll/start, 2fa/enroll/verify — pending_2fa_setup OR session
authRoutes.route('/', twoFactorVerifyRoute)
authRoutes.route('/', twoFactorEnrollPublicRoute)

// --- Protected (authMiddleware + 2FA enforcement guard) ---
const protectedRoutes = new Hono<AppEnv>()
protectedRoutes.use('*', authMiddleware)
protectedRoutes.use('*', require2FAIfEnforced())
protectedRoutes.route('/', logoutRoute)
protectedRoutes.route('/', meRoute)
protectedRoutes.route('/', switchTenantRoute)
protectedRoutes.route('/', inviteCreateRoute)
// auth-2fa protected routes (require authenticated + 2FA-verified session)
protectedRoutes.route('/', twoFactorEnrollRoute)
protectedRoutes.route('/', trustedDevicesRoute)
// app-shell: tenant memberships for workspace switcher
protectedRoutes.route('/', membershipsRoute)

authRoutes.route('/', protectedRoutes)

// --- Settings routes (mounted at /settings/*; also protected) ---
// securitySettingsRoute is mounted here (requirePermission applied inside the handler)
const settingsRoutes = new Hono<AppEnv>()
settingsRoutes.use('*', authMiddleware)
settingsRoutes.use('*', require2FAIfEnforced())
settingsRoutes.route('/', securitySettingsRoute)

authRoutes.route('/', settingsRoutes)

export { authRoutes }