/**
 * @file HTTP surface for AgentHub's own git credentials (git-credentials.js):
 * list, save/replace, delete. Like the AI Proxy routes, nothing here ever
 * returns a password — `GET` reports `hasToken` — and every write is behind
 * the same-origin guard. A lane's fetch/pull/push also saves one, through
 * `POST /api/lanes/:id/git/:action` with `credentials.remember`.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const express = require("express");

const creds = require("../lib/git-credentials");
const { sameOriginGuard } = require("../lib/same-origin");

const router = express.Router();

function fail(res, e) {
  const status = e.code === "EBADHOST" || e.code === "EBADCRED" ? 400 : 500;
  res.status(status).json({ error: { code: e.code || "EINTERNAL", message: e.message } });
}

router.get("/", (_req, res) => {
  res.json({ items: creds.list() });
});

router.post("/", sameOriginGuard, (req, res) => {
  try {
    const { protocol, host, username, password } = req.body || {};
    creds.save({ protocol, host, username, password });
    res.json({ items: creds.list() });
  } catch (e) {
    fail(res, e);
  }
});

router.delete("/:protocol/:host", sameOriginGuard, (req, res) => {
  try {
    if (!creds.remove(req.params.protocol, req.params.host)) {
      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no such credential" } });
    }
    res.json({ items: creds.list() });
  } catch (e) {
    fail(res, e);
  }
});

module.exports = router;