/***********************************************************************************************************************************************************************
 * File Name: client.routes.js
 * Type of Program: Router
 * Description: Protected routes accessible by any authenticated user (client, staff, admin).
 *
 * Route Map:
 *   GET    /api/client/profile          → view own profile
 *   PUT    /api/client/profile          → update own profile
 *   GET    /api/client/sessions         → view own active sessions
 *   DELETE /api/client/sessions/:id     → revoke own session
 *
 * Guards: authenticate → requireClient()
 * Other routes contain here
 *
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 * Modified: Jun. 13, 2026 (by Kenneth Obsequio (@lash0000)
 ***********************************************************************************************************************************************************************/
const express = require('express');
const router = express.Router();
const profileCtrl = require('../../controllers/client/profile.controller');
const { authenticate, softAuthenticate } = require('../../middleware/auth.middleware');
const { requireClient } = require('../../middleware/rbac.middleware');
const { validate } = require('../../middleware/validate.middleware');
const { updateProfileValidator } = require('../../validators/profile.validator');
const { handleAvatarUpload } = require('../../middleware/avatar_upload.middleware');

const tiersRoutes           = require('./tiers.routes');
const coursesRoutes         = require('./courses.routes');
const coursePurchasesRoutes = require('./course_purchases.routes');
const mediaRoutes           = require("./media.routes");
const groupsRoutes          = require("./groups.routes");
const advertisementRoutes   = require('./advertisements.routes');
const notificationRoutes    = require('./notifications.routes');
const certificateCtrl    = require('../../controllers/client/certificate.controller');

// ── Media routes FIRST — before global auth ───────────────────────────────────
// /stream/:token is authenticated by the signed JWT in the URL param, not by
// session cookies. Browser media elements don't send auth headers on range requests.
router.use('/media', mediaRoutes);

// ── Soft-auth routes — return null instead of 401 when unauthenticated ────────
const { unseenCount } = require('../../controllers/client/notification.controller');
router.get('/notifications/unseen', softAuthenticate, unseenCount);

// ── Apply auth + role to all remaining routes ─────────────────────────────────
router.use(authenticate, requireClient());

router.get('/profile',            profileCtrl.getProfile);
router.put('/profile',            ...updateProfileValidator, validate, profileCtrl.updateProfile);
router.post('/profile/avatar',    handleAvatarUpload, profileCtrl.uploadAvatar);
router.delete('/profile/avatar',  profileCtrl.deleteAvatar);
router.get('/sessions',           profileCtrl.getSessions);
router.get('/achievements',       profileCtrl.getAchievements);
router.delete('/sessions/:id',    profileCtrl.revokeSession);

router.use('/tiers', tiersRoutes);
router.use('/courses', coursesRoutes);
router.use('/course-purchases', coursePurchasesRoutes);
router.use('/groups', groupsRoutes);
router.use('/advertisements',  advertisementRoutes);
router.use('/notifications',   notificationRoutes);

router.get('/certificates/:courseUuid', certificateCtrl.getCertificate);

module.exports = router;