package app

import "net/http"

// Wrapping helpers: every app route gets CSRF protection; auth/internal add
// session loading and the appropriate access guard.
func (a *App) pub(h http.HandlerFunc) http.Handler {
	return a.csrf(h)
}
func (a *App) auth(h http.HandlerFunc) http.Handler {
	return a.csrf(a.load(a.requireAuth(h)))
}
func (a *App) internal(h http.HandlerFunc) http.Handler {
	return a.csrf(a.load(a.requireInternal(h)))
}

// Routes mounts the authenticated application routes onto an existing mux.
// The public demo (/, /api/analyze) is registered separately by main.go.
func (a *App) Routes(mux *http.ServeMux) {
	mux.Handle("GET /login", a.pub(a.handleLoginForm))
	mux.Handle("POST /login", a.pub(a.handleLogin))
	mux.Handle("POST /logout", a.pub(a.handleLogout))
	mux.Handle("GET /forgot", a.pub(a.handleForgotForm))
	mux.Handle("POST /forgot", a.pub(a.handleForgot))
	mux.Handle("GET /set-password", a.pub(a.handleSetPasswordForm))
	mux.Handle("POST /set-password", a.pub(a.handleSetPassword))

	mux.Handle("GET /app", a.auth(a.handleApp))
	mux.Handle("POST /app/analyze", a.auth(a.handleAppAnalyze))
	mux.Handle("GET /app/bom/{id}", a.auth(a.handleBOM))

	mux.Handle("GET /admin", a.internal(a.handleAdmin))
	mux.Handle("GET /admin/catalog", a.internal(a.handleCatalog))
	mux.Handle("POST /admin/catalog", a.internal(a.handleCatalogSave))
	mux.Handle("POST /admin/catalog/delete", a.internal(a.handleCatalogDelete))
	mux.Handle("POST /admin/catalog/seed", a.internal(a.handleCatalogSeed))
	mux.Handle("GET /admin/subscribers", a.internal(a.handleSubscribers))
	mux.Handle("POST /admin/subscribers", a.internal(a.handleSubscriberCreate))
	mux.Handle("POST /admin/users", a.internal(a.handleUserCreate))
	mux.Handle("GET /admin/boms", a.internal(a.handleBOMs))
}