// Auth · Register — public self-registration of player accounts.
//
// Mounted at /api/v1/auth/register by auth/index.js, so the single route below
// emits POST /auth/register. Gated in the controller by the player_registration
// setting (403 when closed); here it reuses the shared loginGuards stack plus its
// own per-IP registerLimiter, and accepts the honeypot field.
//
// Invite acceptance is the other account-creating route and lives in
// invite.router.js — it deliberately bypasses the player_registration gate, since
// the invite is its own authority.

const express = require('express')
const { body } = require('express-validator')

const { register, HONEYPOT_FIELD } = require('./auth.controller')
const { loginGuards } = require('./loginGuards')
const { registerLimiter } = require('../../../middleware/rateLimit')
const validate = require('../../../middleware/validate')

const registerRouter = express.Router()

registerRouter.post(
  '/',
  // #swagger.tags = ['Auth']
  // #swagger.summary = 'Register a player account'
  // #swagger.description = 'Creates a self-service player account and logs it in (sets the session cookie). Available only when an admin has enabled password registration (player_registration = password|both); otherwise returns 403. Rate limited and behind bot/backoff guards; a hidden honeypot field must stay empty.'
  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/RegisterRequest" } } } } */
  /* #swagger.responses[200] = { description: 'Account created and session issued', content: { "application/json": { schema: { $ref: "#/components/schemas/LoginResponse" } } } } */
  /* #swagger.responses[400] = { description: 'Validation error or unavailable username', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
  /* #swagger.responses[403] = { description: 'Registration is not open', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  /* #swagger.responses[409] = { description: 'Username already taken', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  /* #swagger.responses[429] = { description: 'Too many attempts (rate limited / backoff)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
  ...loginGuards,
  registerLimiter,
  body('username').isString().trim().isLength({ min: 3, max: 32 }),
  body('password').isString().isLength({ min: 8, max: 64 }),
  body('email').optional({ values: 'falsy' }).isEmail().isLength({ max: 255 }),
  body(HONEYPOT_FIELD).optional(),
  validate,
  register,
)

module.exports = registerRouter