package handlers

import (
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/go-chi/cors"
)

// Router construit le routeur HTTP complet de l'API.
// corsOrigin est l'origine autorisée pour les requêtes cross-origin.
func (a *API) Router(corsOrigin string) http.Handler {
	r := chi.NewRouter()

	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)
	r.Use(middleware.Recoverer)

	// Configuration CORS pour l'origine du frontend.
	allowedOrigins := []string{"*"}
	if corsOrigin != "" {
		allowedOrigins = []string{corsOrigin}
	}
	r.Use(cors.Handler(cors.Options{
		AllowedOrigins:   allowedOrigins,
		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type"},
		ExposedHeaders:   []string{"Content-Disposition"},
		AllowCredentials: true,
		MaxAge:           300,
	}))

	r.Route("/api", func(r chi.Router) {
		r.Get("/health", a.Health)

		// Authentification (routes publiques).
		r.Post("/auth/register", a.Register)
		r.Post("/auth/login", a.Login)
		r.Post("/auth/refresh", a.Refresh)

		// Routes protégées.
		r.Group(func(r chi.Router) {
			r.Use(a.RequireAuth)

			r.Post("/auth/logout", a.Logout)
			r.Get("/me", a.Me)

			r.Get("/documents", a.ListDocuments)
			r.Post("/documents", a.CreateDocument)
			r.Get("/documents/{id}", a.GetDocument)
			r.Get("/documents/{id}/file", a.GetDocumentFile)
			r.Put("/documents/{id}", a.UpdateDocument)
			r.Delete("/documents/{id}", a.DeleteDocument)
		})
	})

	return r
}

// Health répond au healthcheck.
func (a *API) Health(w http.ResponseWriter, r *http.Request) {
	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
}