const router = require('express').Router();
const ctrl = require('../controllers/auth.controller');
const { authenticate, authorize } = require('../middlewares/auth');
const { validate } = require('../middlewares/validate');
const { authSchemas } = require('../validators');

router.post('/login', validate({ body: authSchemas.login }), ctrl.login);
router.post('/verify-totp', validate({ body: authSchemas.verifyTotp }), ctrl.verifyTotp);
router.post('/refresh', ctrl.refresh);
router.post('/logout', ctrl.logout);
router.post(
	'/verify-pin',
	authenticate,
	validate({ body: authSchemas.verifyPin }),
	ctrl.verifyPin
);

// Public — login screen needs user list for avatar selection (no sensitive data returned)
router.get('/users-list', ctrl.listUsers);
// Protected — only authenticated admin or manager can register users
router.post(
	'/register',
	authenticate,
	authorize('admin', 'manager'),
	ctrl.uploadAvatar.single('avatar'),
	validate({ body: authSchemas.register }),
	ctrl.register
);
router.get('/me', authenticate, ctrl.me);

module.exports = router;
