/**
 * Customer portal routes — tenant-portals (wave 9c auth + wave 9d data routes).
 *
 * Public auth:
 *   POST /portal/auth/login
 *   POST /portal/auth/magic
 *   GET  /portal/auth/magic/verify
 *   POST /portal/auth/refresh
 *   POST /portal/auth/logout
 *   POST /portal/auth/forgot-password
 *   POST /portal/auth/reset-password
 *
 * Data (portalAuthMiddleware):
 *   GET  /portal/dashboard
 *   GET  /portal/projects
 *   GET  /portal/invoices
 *   GET  /portal/invoices/:id/html
 *   POST /portal/invoices/:id/pay
 *   GET  /portal/receipts
 *   GET  /portal/receipts/:id/pdf
 *   GET  /portal/tickets
 *   POST /portal/tickets
 *   GET  /portal/tickets/:id
 *   POST /portal/tickets/:id/reply
 *   GET  /portal/kb/spaces
 *   GET  /portal/kb/articles/:id
 *   GET  /portal/proposals
 *   PATCH /portal/profile
 *   PATCH /portal/profile/password
 */
import { Hono } from 'hono'
import { eq } from '@zync/db'
import { createDb, getPortalSettings } from '@zync/db/queries'
import { tenants } from '@zync/db/schema'
import type { AppEnv } from '../../types'
import { portalFilesPortalRoute } from './files'
import { portalAuthRoutes } from './auth'
import { portalPasswordResetRoutes } from './passwordReset'
import { portalDashboardRoutes } from './dashboard'
import { portalProjectsRoutes } from './projects'
import { portalInvoicesRoutes } from './invoices'
import { portalReceiptsRoutes } from './receipts'
import { portalTicketsRoutes } from './tickets'
import { portalKbRoutes } from './kb'
import { portalProposalsRoutes } from './proposals'
import { portalProfileRoutes } from './profile'
import { portalContractsRoutes } from './contracts'

const portalRouter = new Hono<AppEnv>()

// Public bootstrap — branding for portal auth pages (no session required)
portalRouter.get('/bootstrap', async (c) => {
  const tenantSlug = c.req.query('tenantSlug')
  if (!tenantSlug) {
    return c.json({ error: 'tenantSlug required' }, 400)
  }

  const db = createDb(c.env)
  const [tenant] = await db
    .select({
      id: tenants.id,
      name: tenants.name,
      countryCode: tenants.countryCode,
    })
    .from(tenants)
    .where(eq(tenants.slug, tenantSlug))
    .limit(1)

  if (!tenant) {
    return c.json({ error: 'Not found' }, 404)
  }

  const settings = await getPortalSettings(db, tenant.id)

  return c.json({
    tenantName: tenant.name,
    portalName: settings.portal_name,
    portalLogoUrl: settings.portal_logo_url,
    portalPrimaryColorHex: settings.portal_primary_color_hex,
    countryCode: tenant.countryCode,
  })
})

// Public auth (no portalAuthMiddleware)
portalRouter.route('/auth', portalAuthRoutes)
portalRouter.route('/auth', portalPasswordResetRoutes)

// Data routes — each sub-router applies portalAuthMiddleware internally
portalRouter.route('/dashboard', portalDashboardRoutes)
portalRouter.route('/projects', portalProjectsRoutes)
portalRouter.route('/invoices', portalInvoicesRoutes)
portalRouter.route('/receipts', portalReceiptsRoutes)
portalRouter.route('/tickets', portalTicketsRoutes)
portalRouter.route('/kb', portalKbRoutes)
portalRouter.route('/proposals', portalProposalsRoutes)
portalRouter.route('/contracts', portalContractsRoutes)
portalRouter.route('/profile', portalProfileRoutes)

// wave-11 leaf-C: portal file sharing (portalAuthMiddleware)
portalRouter.route('', portalFilesPortalRoute)

export { portalRouter }