// Auth · Invite — email-invite acceptance. Public but token-gated: the invite
// token is the whole authority, which is why acceptance bypasses the
// player_registration setting that register.router.js honours.
//
// Mounted at /api/v1/auth/invite by auth/index.js, so the routes below emit
// GET /auth/invite/:token and POST /auth/invite/:token/accept. Staff issue the
// invites from admin/invites.router.js.

const express = require('express')
const { body, param } = require('express-validator')

const { getInvite, acceptInvite } = require('./invite.controller')
const { HONEYPOT_FIELD } = require('./auth.controller')
const { loginGuards } = require('./loginGuards')
const { registerLimiter } = require('../../../middleware/rateLimit')
const validate = require('../../../middleware/validate')

const inviteRouter = express.Router()

inviteRouter.get(
  '/:token',
  // #swagger.tags = ['Auth']
  // #swagger.summary = 'Look up an email invite by token'
  // #swagger.description = 'Returns the pre-assigned email + role for a valid, pending, unexpired invite so the accept form can render. 404 for anything not currently acceptable.'
  /* #swagger.responses[200] = { description: 'Invite details', content: { "application/json": { schema: { type: "object", properties: { email: { type: "string" }, role: { type: "string" } } } } } } */
  /* #swagger.responses[404] = { description: 'Invalid or expired invite', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  param('token').isString().isLength({ min: 8, max: 128 }),
  validate,
  getInvite,
)
inviteRouter.post(
  '/:token/accept',
  // #swagger.tags = ['Auth']
  // #swagger.summary = 'Accept an email invite (creates the account at the invited role)'
  // #swagger.description = 'Creates the website user at the invite’s pre-assigned role and logs them in (sets the session cookie). Bypasses the player_registration gate — the invite is its own authority. Rate limited + honeypot-guarded like registration.'
  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: "object", required: ["username","password"], properties: { username: { type: "string" }, password: { type: "string" } } } } } } */
  /* #swagger.responses[200] = { description: 'Account created and session issued', content: { "application/json": { schema: { $ref: "#/components/schemas/LoginResponse" } } } } */
  /* #swagger.responses[400] = { description: 'Validation error', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
  /* #swagger.responses[404] = { description: 'Invalid or expired invite', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  /* #swagger.responses[409] = { description: 'Username taken or invite already used', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  ...loginGuards,
  registerLimiter,
  param('token').isString().isLength({ min: 8, max: 128 }),
  body('username').isString().trim().isLength({ min: 3, max: 32 }),
  body('password').isString().isLength({ min: 8, max: 64 }),
  body(HONEYPOT_FIELD).optional(),
  validate,
  acceptInvite,
)

module.exports = inviteRouter
