/***********************************************************************************************************************************************************************
 * File Name: client.routes.js
 * Type of Program: Router
 * Description: Protected routes accessible by any authenticated user (client, staff, admin).
 *
 * Route Map:
 *   GET    /api/client/profile          → view own profile
 *   PUT    /api/client/profile          → update own profile
 *   GET    /api/client/sessions         → view own active sessions
 *   DELETE /api/client/sessions/:id     → revoke own session
 *
 * Guards: authenticate → requireClient()
 *
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 ***********************************************************************************************************************************************************************/
const express  = require('express');
const router   = express.Router();

const profileCtrl = require('../../controllers/client/profile.controller');
const { authenticate } = require('../../middleware/auth.middleware');
const { requireClient } = require('../../middleware/rbac.middleware');
const { validate } = require('../../middleware/validate.middleware');
const { updateProfileValidator } = require('../../validators/profile.validator');

// Apply auth + role to all routes in this file
router.use(authenticate, requireClient());

router.get('/profile',           profileCtrl.getProfile);
router.put('/profile',           ...updateProfileValidator, validate, profileCtrl.updateProfile);
router.get('/sessions',          profileCtrl.getSessions);
router.delete('/sessions/:id',   profileCtrl.revokeSession);

module.exports = router;