// /api/v1/settings — settings any *authenticated* account needs to read, whoever
// they are.
//
// A fifth group alongside /auth, /public, /admin and /player, and deliberately
// not folded into any of them:
//
//   - /public is anonymous, and the admin nav's labels describe the shape of the
//     admin surface — that belongs behind a login.
//   - /admin is `staffOnly` + `requireRole('admin')` on settings, but AdminLayout
//     renders for editors and moderators too, so they could never read their own
//     nav overrides from there (docs/website/THEMING_AND_NAV.md §4.2).
//   - /player is self-service data scoped to req.user.id. These rows are
//     site-wide configuration that happens to need a login, not anything about
//     the caller.
//
// Group gate: authenticated only, no role restriction — staff and players alike
// read their own layout's nav. It lives here, ahead of every mount, so a route
// added later cannot ship ungated.

const express = require('express')

const { requireAuth } = require('../../../auth/session.middleware')
const noindex = require('../../../middleware/noindex')

const navRouter = require('./nav.router')
const themeRouter = require('./theme.router')

const settingsRouter = express.Router()

settingsRouter.use(noindex, requireAuth)

settingsRouter.use('/nav', navRouter)
settingsRouter.use('/theme', themeRouter)

module.exports = settingsRouter
