const express = require('express')

const requireInternalKey = require('../../../middleware/requireInternalKey')
const ctrl = require('./internal.controller')

const router = express.Router()

// Shared-secret gated, not session-gated — the caller is the bot process, not
// a logged-in browser. This router is mounted on the standalone internalApp
// (its own unpublished port), never on the public /api app. See internalApp.js.
router.use(requireInternalKey)

router.get(
  '/bot-config',
  // #swagger.ignore = true
  ctrl.getBotConfig,
)

// The slash-command seam (TEAMS.md §7.1). Both stay off the public API and out
// of the OpenAPI document for the same reason /bot-config does: the caller is
// the bot process on the private compose network, and `/internal/*` is not a
// published contract.
router.get(
  '/commands',
  // #swagger.ignore = true
  ctrl.listCommands,
)

router.post(
  '/commands/dispatch',
  // #swagger.ignore = true
  ctrl.dispatchCommand,
)

module.exports = router