const express = require('express')

const ctrl = require('./engagement.controller')

const engagementRouter = express.Router()

// ── One-click unsubscribe (ENGAGEMENT.md Phase 6) ──────────────────────────
//
// The canonical home of the unsubscribe pair, generalized off
// `/public/teams/unsubscribe/:token`. That path still exists and still works —
// see `teams.router.js` — because links in mail already sent cannot be rewritten.
//
// No `siteMode`, unlike almost every other public route. An unsubscribe has to
// work while the site is in maintenance: the mail that carried the link went out
// before the site went down, and "we are doing maintenance" is not an answer to
// "stop emailing me".
engagementRouter.post(
  '/unsubscribe/:token',
  // #swagger.tags = ['Public · Engagement']
  // #swagger.summary = 'Unsubscribe from one channel for one scope'
  // #swagger.description = 'Honours the tokened link in an engagement email, including RFC 8058 one-click. The token names a delivery channel and a scope; the write turns that channel off for that scope and nothing else. Always answers 200 — a response that distinguished a valid token from a forged one would be an oracle for which (user, scope) pairs exist. Tokens signed before this route existed are still honoured, at this path and at the older /public/teams one.'
  // #swagger.parameters['token'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'The signed token from the email link.' }
  // #swagger.security = [{}]
  /* #swagger.responses[200] = { description: 'Acknowledged', content: { "application/json": { schema: { $ref: "#/components/schemas/OkFlag" } } } } */
  ctrl.unsubscribe,
)

engagementRouter.get(
  '/unsubscribe/:token',
  // #swagger.tags = ['Public · Engagement']
  // #swagger.summary = 'Land a human on the unsubscribe page'
  // #swagger.description = 'For mail clients that render the List-Unsubscribe URL as an ordinary link. Redirects to the site’s own confirmation page and changes nothing — a GET must not mutate, or a link scanner would unsubscribe people who asked for nothing.'
  // #swagger.parameters['token'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'The signed token from the email link.' }
  // #swagger.security = [{}]
  /* #swagger.responses[302] = { description: 'Redirect to the site’s unsubscribe page' } */
  ctrl.unsubscribeLanding,
)

module.exports = engagementRouter