// Auth · Session — the two session-lifecycle singletons that own no path segment
// of their own: POST /auth/logout and GET /auth/me.
//
// Mounted at the group root by auth/index.js, **last**. This is the auth group's
// counterpart to admin/dashboard.router.js, and the same two rules apply:
//
//  1. **No router-level middleware here.** A bare `use(gate)` in a root-mounted
//     router runs for every request passing through toward another mount, so it
//     would gate /auth/login and /auth/mobile/* too. Keep gates on the routes.
//
//  2. **The mount must stay last.** `authRouter.use('/me', meRouter)` matches the
//     bare path /me as well as /me/*, so a request to GET /auth/me runs meRouter's
//     `noindex, requireAuth` (and notifRouter's), finds no matching route inside
//     either, and falls through to the handler below. Mounting this router ahead
//     of them would answer /auth/me first and silently drop the X-Robots-Tag
//     header those routers apply. Verified by asserting the response headers, not
//     by reading the mount table.
//
// Splitting the session is elsewhere by client: mobile.routes.js revokes refresh
// tokens, and me.routes.js owns DELETE /auth/me/sessions/:id.

const express = require('express')

const { logout, me } = require('./auth.controller')
const { isLoggedIn } = require('../../../utils/auth')
const { attachSession } = require('../../../auth/session.middleware')

const sessionRouter = express.Router()

sessionRouter.post(
  '/logout',
  // #swagger.tags = ['Auth']
  // #swagger.summary = 'Log out (clear the cookie and revoke this session)'
  /* #swagger.responses[200] = { description: 'Logged out', content: { "application/json": { schema: { $ref: "#/components/schemas/Message" } } } } */
  // Best-effort attach (never rejects) so the controller can revoke this session's
  // jti — logout stays a no-op for an already-anonymous caller.
  attachSession,
  logout,
)
sessionRouter.get(
  '/me',
  // #swagger.tags = ['Auth']
  // #swagger.summary = 'Current authenticated user'
  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
  /* #swagger.responses[200] = { description: 'The signed-in user', content: { "application/json": { schema: { type: "object", properties: { user: { $ref: "#/components/schemas/User" } } } } } } */
  /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  isLoggedIn,
  me,
)

module.exports = sessionRouter
