/***********************************************************************************************************************************************************************
 * File Name: auth.routes.js
 * Type of Program: Router
 * Description: Public authentication routes (no auth required).
 *              CSRF protection is applied to state-mutating endpoints.
 *
 * Route Map:
 *   GET  /api/auth/csrf-token        → get CSRF token (for cookie-based clients)
 *   POST /api/auth/register          → system registration
 *   POST /api/auth/verify-otp        → OTP verification + auto-login
 *   POST /api/auth/resend-otp        → resend OTP email
 *   POST /api/auth/login             → system login
 *   POST /api/auth/refresh           → refresh access token
 *   POST /api/auth/logout            → logout (requires authenticate)
 *   POST /api/auth/change-password   → change password (requires authenticate)
 *   GET  /api/auth/google            → initiate Google OIDC (generates state/nonce/PKCE)
 *   GET  /api/auth/google/callback   → Google OIDC callback (verifies + exchanges code)
 *
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 ***********************************************************************************************************************************************************************/
const express = require('express');
const router  = express.Router();

const authCtrl = require('../controllers/auth.controller');
const { authenticate } = require('../middleware/auth.middleware');
const { authLimiter, otpLimiter, sensitiveOpsLimiter } = require('../middleware/rateLimiter.middleware');
const { csrfProtection, getCsrfToken } = require('../middleware/csrf.middleware');
const { validate } = require('../middleware/validate.middleware');
const {
  registerValidator, loginValidator,
  verifyOTPValidator, resendOTPValidator, changePassValidator,
} = require('../validators/auth.validator');

// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
router.get('/csrf-token', csrfProtection, getCsrfToken);

// ── System auth ────────────────────────────────────────────────────────────────
router.post('/register', ...registerValidator, validate, authCtrl.register);
router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
router.post('/login', ...loginValidator, validate, authCtrl.login);
router.post('/refresh', authCtrl.refreshToken);
router.post('/logout', authenticate, authLimiter, authCtrl.logout);
router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);

// ── Google OIDC ────────────────────────────────────────────────────────────────
router.get('/google', authLimiter, authCtrl.googleRedirect);
router.get('/google/callback', authCtrl.googleCallback);

module.exports = router;