package api

import (
	"github.com/gin-gonic/gin"

	"oci-portal/internal/service"
)

// registerAuthPublic 公开登录/OAuth 路由(不经 JWT)。
func registerAuthPublic(v1 *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, systemLogs *service.SystemLogService) {
	ah := &authHandler{svc: auth, logs: systemLogs}
	v1.POST("/auth/login", ah.login)

	// 外部身份登录:provider 列表 / 授权跳转(bind 模式 handler 内校验 JWT)/ 回调
	ax := &authxHandler{auth: auth, oauth: oauth, logs: systemLogs}
	v1.GET("/auth/oauth/providers", ax.oauthProviders)
	v1.GET("/auth/oauth/:provider/authorize", ax.oauthAuthorize)
	v1.GET("/auth/oauth/:provider/callback", ax.oauthCallback)
}

// registerAuthSecured 登出、两步验证、外部身份管理(JWT 组内)。
func registerAuthSecured(secured *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, settings *service.SettingService, systemLogs *service.SystemLogService) {
	ah := &authHandler{svc: auth, logs: systemLogs}
	secured.POST("/auth/logout", ah.logout)

	ax := &authxHandler{auth: auth, oauth: oauth}
	secured.GET("/auth/totp", ax.totpStatus)
	secured.POST("/auth/totp/setup", ax.totpSetup)
	secured.GET("/auth/credentials", ax.getCredentials)
	secured.PUT("/auth/credentials", ax.updateCredentials)
	secured.GET("/auth/identities", ax.identities)
	secured.POST("/auth/totp/activate", ax.totpActivate)
	secured.POST("/auth/totp/disable", ax.totpDisable)
	secured.PUT("/auth/password-login", ax.updatePasswordLogin)
	secured.DELETE("/auth/identities/:id", ax.unbindIdentity)
	secured.POST("/auth/revoke-sessions", ax.revokeSessions)
	secured.GET("/settings/oauth", func(c *gin.Context) { ax.getOAuthSettings(c, settings) })
	secured.PUT("/settings/oauth", func(c *gin.Context) { ax.updateOAuthSettings(c, settings) })
}