package main

import (

	"net/http"

	"github.com/stevedylandev/andromeda/pkg/auth"

	"github.com/stevedylandev/andromeda/pkg/darkmatter"

	"github.com/stevedylandev/andromeda/pkg/web"

)

func (a *App) routes() *http.ServeMux {

	mux := http.NewServeMux()

	requireSession := func(next http.HandlerFunc) http.HandlerFunc {

		return a.Sessions.RequireSession("/login", next)

	}

	requireAPIKey := func(next http.HandlerFunc) http.HandlerFunc {

		return auth.RequireAPIKey(a.APIKey, next)

	}

	// Public: only the login flow and static assets.

	mux.HandleFunc("GET /login", a.loginGetHandler)

	mux.HandleFunc("POST /login", a.loginPostHandler)

	mux.HandleFunc("GET /logout", a.logoutHandler)

	mux.HandleFunc("GET /static/", web.EmbeddedHandler(appFS, "static"))

	darkmatter.Mount(mux, "/assets")

	// Everything else requires a session (fully gated admin app).

	mux.HandleFunc("GET /", requireSession(a.dashboardHandler))

	mux.HandleFunc("GET /new", requireSession(a.newHabitHandler))

	mux.HandleFunc("GET /settings", requireSession(a.settingsHandler))

	mux.HandleFunc("GET /export.csv", requireSession(a.exportHandler))

	mux.HandleFunc("POST /habits", requireSession(a.createHabitHandler))

	mux.HandleFunc("GET /habits/{short_id}", requireSession(a.habitDetailHandler))

	mux.HandleFunc("POST /habits/{short_id}", requireSession(a.updateHabitHandler))

	mux.HandleFunc("POST /habits/{short_id}/delete", requireSession(a.deleteHabitHandler))

	mux.HandleFunc("POST /records", requireSession(a.createRecordHandler))

	mux.HandleFunc("POST /records/{short_id}", requireSession(a.updateRecordHandler))

	mux.HandleFunc("POST /records/{short_id}/delete", requireSession(a.deleteRecordHandler))

	// Read-only JSON API, gated by X-API-Key (disabled when key is empty).

	mux.HandleFunc("GET /api/habits", requireAPIKey(a.apiListHabits))

	mux.HandleFunc("GET /api/records", requireAPIKey(a.apiListRecords))

	return mux

}