/**
 * @file auth.js
 * @description `/api/auth` — who is logged in, login and logout for server mode
 * (server/lib/auth.js, docs/SERVER-MODE.md). `GET /me` answers in local mode
 * too (`{mode: "local"}`) so the client knows whether to show a login page;
 * login and logout exist only in server mode. Accounts are made with the CLI
 * (`agenthub server setup`, `agenthub users …`), never by a route.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { Router } = require("express");
const auth = require("../lib/auth");
const { sameOriginGuard } = require("../lib/same-origin");

const router = Router();

router.get("/me", (req, res) => {
  if (!auth.isServerMode()) return res.json({ mode: "local" });
  res.json({ mode: "server", user: auth.userFromRequest(req) });
});

router.post("/login", sameOriginGuard, async (req, res) => {
  if (!auth.isServerMode()) {
    return res.status(404).json({ error: { code: "ENOTSERVER", message: "not in server mode" } });
  }
  try {
    const { user, token } = await auth.login(req, req.body?.username, req.body?.password);
    auth.setLoginCookie(req, res, token);
    res.json({ user });
  } catch (e) {
    const status = e.code === "ETOOMANY" ? 429 : e.code === "EBADLOGIN" ? 401 : 500;
    res.status(status).json({ error: { code: e.code || "EAUTH", message: e.message } });
  }
});

router.post("/logout", sameOriginGuard, (req, res) => {
  auth.endSession(auth.cookieToken(req));
  auth.clearLoginCookie(req, res);
  res.json({ ok: true });
});

module.exports = router;