import { Router } from 'express';

import { authenticate } from '../../middlewares/auth.middleware';

import { oidcController } from './oidc.controller';

/**
 * EN: Create and configure OIDC routes
 * VI: Tạo và cấu hình routes cho OIDC
 */
export const createOidcRouter = (): Router => {
    const router = Router();

    /**
     * @swagger
     * /.well-known/openid-configuration:
     *   get:
     *     summary: OIDC Discovery
     *     description: Get OpenID Connect configuration and metadata
     *     tags: [OIDC]
     *     responses:
     *       200:
     *         description: OIDC configuration
     *         content:
     *           application/json:
     *             schema:
     *               type: object
     *               properties:
     *                 issuer:
     *                   type: string
     *                 authorization_endpoint:
     *                   type: string
     *                 token_endpoint:
     *                   type: string
     *                 userinfo_endpoint:
     *                   type: string
     *                 jwks_uri:
     *                   type: string
     */
    // Note: This route is usually mounted at root, not under /api/{version}
    // If mounted under /api/{version}, adjust paths accordingly
    router.get('/.well-known/openid-configuration', oidcController.discovery.bind(oidcController));

    /**
     * @swagger
     * /api/{version}/oidc/authorize:
     *   get:
     *     summary: OIDC Authorization
     *     description: Authorization endpoint for OIDC flow
     *     tags: [OIDC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *       - in: query
     *         name: response_type
     *         required: true
     *         schema:
     *           type: string
     *       - in: query
     *         name: client_id
     *         required: true
     *         schema:
     *           type: string
     *       - in: query
     *         name: redirect_uri
     *         required: true
     *         schema:
     *           type: string
     *       - in: query
     *         name: scope
     *         schema:
     *           type: string
     *       - in: query
     *         name: state
     *         schema:
     *           type: string
     *     responses:
     *       302:
     *         description: Redirect to callback
     *       400:
     *         description: Invalid request
     */
    router.get('/authorize', authenticate(), oidcController.authorize.bind(oidcController));

    /**
     * @swagger
     * /api/{version}/oidc/token:
     *   post:
     *     summary: OIDC Token
     *     description: Token endpoint for OIDC flow
     *     tags: [OIDC]
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/x-www-form-urlencoded:
     *           schema:
     *             type: object
     *             properties:
     *               grant_type:
     *                 type: string
     *               code:
     *                 type: string
     *               redirect_uri:
     *                 type: string
     *               client_id:
     *                 type: string
     *               client_secret:
     *                 type: string
     *     responses:
     *       200:
     *         description: ID Token and Access Token
     *       400:
     *         description: Invalid request
     */
    router.post('/token', oidcController.token.bind(oidcController));

    /**
     * @swagger
     * /api/{version}/oidc/userinfo:
     *   get:
     *     summary: OIDC UserInfo
     *     description: Get claims about the authenticated end-user
     *     tags: [OIDC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     responses:
     *       200:
     *         description: User information
     *         content:
     *           application/json:
     *             schema:
     *               type: object
     *               properties:
     *                 sub:
     *                   type: string
     *                 name:
     *                   type: string
     *                 email:
     *                   type: string
     *       401:
     *         description: Unauthorized
     */
    router.get('/userinfo', authenticate(), oidcController.userinfo.bind(oidcController));

    /**
     * @swagger
     * /api/{version}/oidc/jwks:
     *   get:
     *     summary: OIDC JWKS
     *     description: JSON Web Key Set for verifying signatures
     *     tags: [OIDC]
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     responses:
     *       200:
     *         description: JWKS
     *         content:
     *           application/json:
     *             schema:
     *               type: object
     *               properties:
     *                 keys:
     *                   type: array
     *                   items:
     *                     type: object
     */
    router.get('/jwks', oidcController.jwks.bind(oidcController));

    return router;
};
