import type { FastifyInstance } from 'fastify';
import type { LoginRequest, LoginResponse, MeResponse } from '@arboretum/shared';
import type { AuthService, LoginRateLimiter } from '../auth/service.js';

export function registerAuthRoutes(
  app: FastifyInstance,
  auth: AuthService,
  limiter: LoginRateLimiter,
  serverVersion: string,
): void {
  app.post('/api/v1/auth/login', { config: { public: true } }, async (req, reply) => {
    const wait = limiter.check();
    if (wait !== null) {
      return reply.status(429).send({ error: { code: 'RATE_LIMITED', message: `Retry in ${Math.ceil(wait / 1000)}s` } });
    }
    const body = req.body as Partial<LoginRequest> | null;
    const ctx = typeof body?.token === 'string' ? auth.verifyRawToken(body.token) : null;
    if (!ctx) {
      limiter.recordFailure();
      return reply.status(401).send({ error: { code: 'BAD_TOKEN', message: 'Invalid token' } });
    }
    limiter.recordSuccess();
    void reply.setCookie(auth.cookieName, auth.issueCookie(ctx), {
      path: '/',
      httpOnly: true,
      sameSite: 'strict',
      maxAge: 30 * 24 * 3600,
    });
    const res: LoginResponse = { ok: true, label: ctx.label };
    return reply.send(res);
  });

  app.get('/api/v1/auth/me', async (req, reply) => {
    const res: MeResponse = { ok: true, tokenLabel: req.authContext?.label ?? 'unknown', serverVersion };
    return reply.send(res);
  });

  app.post('/api/v1/auth/logout', async (_req, reply) => {
    void reply.clearCookie(auth.cookieName, { path: '/' });
    return reply.send({ ok: true });
  });
}
