import express from 'express';
import * as authController from '../controllers/auth.controller.js';
import { authenticate } from '../middlewares/auth/authMiddleware.js';
import { validateBody } from '../middlewares/security/validateInput.js';
import {
  loginSchema,
  setPasswordSchema,
} from '../validators/auth.validators.js';
import {
  loginRateLimiter,
  sensitiveOperationLimiter,
} from '../middlewares/security/rateLimiter.js';

const router = express.Router();

/**
 * Public routes (bez autentifikácie)
 */

// KROK 1: Login s temporary password
router.post(
  '/login',
  loginRateLimiter,
  validateBody(loginSchema),
  authController.login
);

// Refresh access token (public - uses refresh token from cookie)
router.post('/refresh', authController.refreshToken);

/**
 * Protected routes (vyžadujú autentifikáciu)
 */

// KROK 2: Set new password
router.post(
  '/set-password',
  authenticate,
  sensitiveOperationLimiter,
  validateBody(setPasswordSchema),
  authController.setPassword
);

// Logout
router.post('/logout', authenticate, authController.logout);

// Get current session
router.get('/session', authenticate, authController.getSession);

export default router;
