spread

package app

import "net/http"

// Wrapping helpers: every app route gets CSRF protection; auth/internal add

// session loading and the appropriate access guard.

func (a *App) pub(h http.HandlerFunc) http.Handler {

	return a.csrf(h)

}

func (a *App) auth(h http.HandlerFunc) http.Handler {

	return a.csrf(a.load(a.requireAuth(h)))

}

func (a *App) internal(h http.HandlerFunc) http.Handler {

	return a.csrf(a.load(a.requireInternal(h)))

}

// Routes mounts the authenticated application routes onto an existing mux.

// The public demo (/, /api/analyze) is registered separately by main.go.

func (a *App) Routes(mux *http.ServeMux) {

	mux.Handle("GET /login", a.pub(a.handleLoginForm))

	mux.Handle("POST /login", a.pub(a.handleLogin))

	mux.Handle("POST /logout", a.pub(a.handleLogout))

	mux.Handle("GET /forgot", a.pub(a.handleForgotForm))

	mux.Handle("POST /forgot", a.pub(a.handleForgot))

	mux.Handle("GET /set-password", a.pub(a.handleSetPasswordForm))

	mux.Handle("POST /set-password", a.pub(a.handleSetPassword))

	mux.Handle("GET /app", a.auth(a.handleApp))

	mux.Handle("POST /app/analyze", a.auth(a.handleAppAnalyze))

	mux.Handle("GET /app/bom/{id}", a.auth(a.handleBOM))

	mux.Handle("GET /admin", a.internal(a.handleAdmin))

	mux.Handle("GET /admin/catalog", a.internal(a.handleCatalog))

	mux.Handle("POST /admin/catalog", a.internal(a.handleCatalogSave))

	mux.Handle("POST /admin/catalog/delete", a.internal(a.handleCatalogDelete))

	mux.Handle("POST /admin/catalog/seed", a.internal(a.handleCatalogSeed))

	mux.Handle("GET /admin/subscribers", a.internal(a.handleSubscribers))

	mux.Handle("POST /admin/subscribers", a.internal(a.handleSubscriberCreate))

	mux.Handle("POST /admin/users", a.internal(a.handleUserCreate))

	mux.Handle("GET /admin/boms", a.internal(a.handleBOMs))

}