import { Router } from 'express';
import rateLimit from 'express-rate-limit';
import { requireAuth } from '../../middleware/auth.js';
import { requireVaultUnlock } from './middleware.js';
import {
  getStatus, postPin, postUnlock, postChangePin, postForgotPin, postResetPin,
  getEntries, getEntry, postEntry, putEntry, deleteEntry,
  getGroups, postGroup, putGroup, deleteGroup, postGroupShare,
  getEntryShares, postEntryShare, deleteEntryShare,
} from './controller.js';

const router = Router();

// PIN de 4 digitos: 10,000 combinaciones -- sin este limiter seria trivial de forzar.
const unlockLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 8, standardHeaders: true, legacyHeaders: false });

// Publico, como auth/reset-password: el link del correo puede abrirse sin sesion activa.
router.post('/reset-pin', unlockLimiter, postResetPin);

router.use(requireAuth);
router.get('/status', getStatus);
router.post('/pin', postPin);
router.post('/unlock', unlockLimiter, postUnlock);
router.post('/change-pin', unlockLimiter, postChangePin);
router.post('/forgot-pin', unlockLimiter, postForgotPin);

router.get('/groups', requireVaultUnlock, getGroups);
router.post('/groups', requireVaultUnlock, postGroup);
router.put('/groups/:id', requireVaultUnlock, putGroup);
router.delete('/groups/:id', requireVaultUnlock, deleteGroup);
router.post('/groups/:id/share', requireVaultUnlock, postGroupShare);

router.get('/entries', requireVaultUnlock, getEntries);
router.get('/entries/:id', requireVaultUnlock, getEntry);
router.post('/entries', requireVaultUnlock, postEntry);
router.put('/entries/:id', requireVaultUnlock, putEntry);
router.delete('/entries/:id', requireVaultUnlock, deleteEntry);

router.get('/entries/:id/shares', requireVaultUnlock, getEntryShares);
router.post('/entries/:id/shares', requireVaultUnlock, postEntryShare);
router.delete('/entries/:id/shares/:userId', requireVaultUnlock, deleteEntryShare);

export default router;