package api

import (
	"github.com/gin-gonic/gin"

	"oci-portal/internal/service"
)

// registerAuthPublic 公开登录/OAuth/通行密钥/钱包路由(不经 JWT)。
func registerAuthPublic(v1 *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, passkeys *service.PasskeyService, wallets *service.WalletService, systemLogs *service.SystemLogService) {
	ah := &authHandler{svc: auth, logs: systemLogs}
	v1.POST("/auth/login", ah.login)

	// 外部身份登录:provider 列表 / 授权跳转(bind 模式 handler 内校验 JWT)/ 回调
	ax := &authxHandler{auth: auth, oauth: oauth, passkeys: passkeys, wallets: wallets, logs: systemLogs}
	v1.GET("/auth/oauth/providers", ax.oauthProviders)
	v1.GET("/auth/oauth/:provider/authorize", ax.oauthAuthorize)
	v1.GET("/auth/oauth/:provider/callback", ax.oauthCallback)

	// 通行密钥登录:断言 options 公开下发,finish 内部接入登录守卫
	pk := &passkeyHandler{svc: passkeys, auth: auth, logs: systemLogs}
	v1.POST("/auth/passkey/login/begin", pk.loginBegin)
	v1.POST("/auth/passkey/login/finish", pk.loginFinish)

	// 钱包登录/绑定:挑战-签名两段式(bind 模式 handler 内校验 JWT)
	wl := &walletHandler{svc: wallets, auth: auth, logs: systemLogs}
	v1.POST("/auth/wallet/challenge", wl.challenge)
	v1.POST("/auth/wallet/verify", wl.verify)
}

// registerAuthSecured 登出、两步验证、外部身份与通行密钥管理(JWT 组内)。
func registerAuthSecured(secured *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, passkeys *service.PasskeyService, settings *service.SettingService, systemLogs *service.SystemLogService) {
	ah := &authHandler{svc: auth, logs: systemLogs}
	secured.POST("/auth/logout", ah.logout)

	pk := &passkeyHandler{svc: passkeys, auth: auth}
	secured.POST("/auth/passkey/register/begin", pk.registerBegin)
	secured.POST("/auth/passkey/register/finish", pk.registerFinish)
	secured.GET("/auth/passkeys", pk.list)
	secured.DELETE("/auth/passkeys/:id", pk.remove)

	// 活跃会话:查看与定点撤销
	sh := &sessionHandler{auth: auth}
	secured.GET("/auth/sessions", sh.list)
	secured.DELETE("/auth/sessions/:id", sh.revoke)

	ax := &authxHandler{auth: auth, oauth: oauth}
	secured.GET("/auth/totp", ax.totpStatus)
	secured.POST("/auth/totp/setup", ax.totpSetup)
	secured.GET("/auth/credentials", ax.getCredentials)
	secured.PUT("/auth/credentials", ax.updateCredentials)
	secured.GET("/auth/identities", ax.identities)
	secured.POST("/auth/totp/activate", ax.totpActivate)
	secured.POST("/auth/totp/disable", ax.totpDisable)
	secured.PUT("/auth/password-login", ax.updatePasswordLogin)
	secured.DELETE("/auth/identities/:id", ax.unbindIdentity)
	secured.POST("/auth/revoke-sessions", ax.revokeSessions)
	secured.GET("/settings/oauth", func(c *gin.Context) { ax.getOAuthSettings(c, settings) })
	secured.PATCH("/settings/oauth", func(c *gin.Context) { ax.updateOAuthSettings(c, settings) })
}