use axum::Router;
use axum::middleware;
use axum::routing::{delete, get, post, put};

use crate::handlers::accept_agreement::accept_agreement;
use crate::handlers::agreement_page::agreement_page;
use crate::handlers::create_report::create_report;
use crate::handlers::delete_notification::delete_notification;
use crate::handlers::get_preferences::get_preferences;
use crate::handlers::get_user::get_user;
use crate::handlers::list_agreements::list_agreements;
use crate::handlers::list_notifications::list_notifications;
use crate::handlers::me::me;
use crate::handlers::unread_notifications_count::unread_notifications_count;
use crate::handlers::update_preferences::update_preferences;
use crate::handlers::update_profile::update_profile;
use crate::handlers::users;
use crate::oauth;
use crate::services::AuthService;
use crate::share::guard::auth_guard;

pub fn router(service: AuthService) -> Router<AuthService> {
    let public = Router::new()
        .route("/auth/login", get(oauth::login::login))
        .route("/auth/signup", get(oauth::login::signup))
        .route("/auth/callback", get(oauth::callback::callback))
        .route("/auth/refresh", post(oauth::refresh::refresh))
        .route("/auth/logout", post(oauth::logout::logout))
        .route("/auth/agreements", get(list_agreements));

    let authed = Router::new()
        .route("/users", get(users::list_users_batch))
        .route(
            "/users/by-username/{username}",
            get(users::get_user_by_username),
        )
        .route("/users/{user_id}", get(get_user))
        .route("/me", get(me).patch(update_profile))
        .route("/auth/jwt-request", get(crate::handlers::jwt_request::jwt_request))
        .route("/me/username", put(users::update_username))
        .route(
            "/me/preferences",
            get(get_preferences).patch(update_preferences),
        )
        .route("/me/agreements/{key}", put(accept_agreement))
        .route("/me/notifications", get(list_notifications))
        .route(
            "/me/notifications/unread-count",
            get(unread_notifications_count),
        )
        .route(
            "/me/notifications/{notification_id}",
            delete(delete_notification),
        )
        .route(
            "/me/notifications/read",
            put(crate::handlers::mark_notifications_read::mark_notifications_read),
        )
        .route("/me/reports", post(create_report))
        .route(
            "/auth/password/change",
            post(crate::handlers::password::change_password),
        )
        .route("/auth/2fa/status", get(crate::handlers::two_factor::totp_status))
        .route("/auth/2fa/setup", post(crate::handlers::two_factor::totp_setup))
        .route("/auth/2fa/enable", post(crate::handlers::two_factor::totp_enable))
        .route("/auth/2fa/disable", post(crate::handlers::two_factor::totp_disable))
        .route(
            "/auth/2fa/recovery-codes",
            get(crate::handlers::two_factor::recovery_codes)
                .put(crate::handlers::two_factor::regenerate_recovery_codes),
        )
        .route(
            "/auth/access-keys",
            get(crate::handlers::access_keys::list_access_keys)
                .post(crate::handlers::access_keys::create_access_key),
        )
        .route(
            "/auth/access-keys/{key_id}",
            delete(crate::handlers::access_keys::delete_access_key),
        )
        .route(
            "/auth/access-keys/{key_id}/rotate",
            post(crate::handlers::access_keys::rotate_access_key),
        )
        .route(
            "/auth/ssh-keys",
            get(crate::handlers::ssh_keys::list_ssh_keys)
                .post(crate::handlers::ssh_keys::add_ssh_key),
        )
        .route(
            "/auth/ssh-keys/{key_id}",
            delete(crate::handlers::ssh_keys::delete_ssh_key),
        )
        .route(
            "/me/sessions",
            get(crate::handlers::sessions::list_sessions)
                .delete(crate::handlers::sessions::revoke_all_sessions),
        )
        .route(
            "/me/sessions/{session_id}",
            delete(crate::handlers::sessions::revoke_session),
        )
        .route(
            "/me/devices",
            get(crate::handlers::devices::list_devices),
        )
        .route_layer(middleware::from_fn_with_state(service, auth_guard));

    public.merge(authed)
}

pub fn pages_router(service: AuthService) -> Router {
    Router::new()
        .route("/agreements/{key}", get(agreement_page))
        .with_state(service)
}