package api

import (
	"net/http"
)

const defaultAllowedOrigin = "http://localhost:5173"

// NewRouter builds the HTTP API with setup gating, auth, and network middleware.
func NewRouter(configDir string) http.Handler {
	app, err := newApp(configDir)
	if err != nil {
		// newApp currently always succeeds; keep signature for future.
		panic(err)
	}

	mux := http.NewServeMux()
	mux.HandleFunc("GET /health", HealthHandler)
	mux.HandleFunc("GET /api/v1/status", StatusHandler)

	mux.HandleFunc("GET /api/v1/setup/status", app.setupStatusHandler)
	mux.HandleFunc("POST /api/v1/setup/totp/begin", app.setupTOTPBeginHandler)
	mux.HandleFunc("POST /api/v1/setup/totp/verify", app.setupTOTPVerifyHandler)
	mux.HandleFunc("POST /api/v1/setup/network/preview", app.setupPreviewHandler)
	mux.HandleFunc("POST /api/v1/setup/complete", app.setupCompleteHandler)

	mux.HandleFunc("POST /api/v1/auth/login", app.loginHandler)
	mux.HandleFunc("POST /api/v1/auth/logout", app.logoutHandler)
	mux.HandleFunc("GET /api/v1/auth/me", app.meHandler)

	mux.HandleFunc("GET /api/v1/groups", groupsGetHandler(configDir))
	mux.HandleFunc("POST /api/v1/groups", groupsUpsertHandler(configDir))
	mux.HandleFunc("DELETE /api/v1/groups", groupsDeleteHandler(configDir))
	mux.HandleFunc("GET /api/v1/security", securityGetHandler(configDir))
	mux.HandleFunc("PUT /api/v1/security", securityPutHandler(configDir))
	mux.HandleFunc("GET /api/v1/network", networkGetHandler(configDir))
	mux.HandleFunc("PUT /api/v1/network", networkPutHandler(configDir))
	mux.HandleFunc("GET /api/v1/users", app.usersGetHandler)
	mux.HandleFunc("DELETE /api/v1/users", app.usersDeleteHandler)

	return app.withCORS(app.withMiddleware(mux))
}