import { Router } from 'express';

import { authenticate } from '../../middlewares/auth.middleware';

import { mfaController } from './mfa.controller';

/**
 * EN: Create and configure MFA routes
 * VI: Tạo và cấu hình routes cho MFA
 */
export const createMfaRouter = (): Router => {
    const router = Router();

    /**
     * @swagger
     * /api/{version}/mfa/totp/enable:
     *   post:
     *     summary: Enable TOTP
     *     description: Initiate process to enable TOTP (Time-based One-Time Password) for the user
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     responses:
     *       200:
     *         description: TOTP setup initiated (returns QR code URL or secret)
     *         content:
     *           application/json:
     *             schema:
     *               allOf:
     *                 - $ref: '#/components/schemas/ApiResponse'
     *                 - type: object
     *                   properties:
     *                     data:
     *                       type: object
     *                       properties:
     *                         secret:
     *                           type: string
     *                         qrCode:
     *                           type: string
     *       401:
     *         description: Unauthorized
     */
    router.post('/totp/enable', authenticate(), mfaController.enableTOTP.bind(mfaController));

    /**
     * @swagger
     * /api/{version}/mfa/totp/verify:
     *   post:
     *     summary: Verify and Enable TOTP
     *     description: Verify the TOTP code and finalize enabling MFA
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [code]
     *             properties:
     *               code:
     *                 type: string
     *                 description: The 6-digit TOTP code
     *     responses:
     *       200:
     *         description: TOTP verified and enabled successfully
     *         content:
     *           application/json:
     *             schema:
     *               $ref: '#/components/schemas/ApiResponse'
     *       400:
     *         description: Invalid code
     *       401:
     *         description: Unauthorized
     */
    router.post('/totp/verify', authenticate(), mfaController.verifyAndEnableTOTP.bind(mfaController));

    /**
     * @swagger
     * /api/{version}/mfa/totp/validate:
     *   post:
     *     summary: Validate TOTP
     *     description: Validate a TOTP code (for login or step-up auth)
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [code]
     *             properties:
     *               code:
     *                 type: string
     *                 description: The 6-digit TOTP code
     *     responses:
     *       200:
     *         description: Code valid
     *         content:
     *           application/json:
     *             schema:
     *               allOf:
     *                 - $ref: '#/components/schemas/ApiResponse'
     *                 - type: object
     *                   properties:
     *                     data:
     *                       type: object
     *                       properties:
     *                         valid:
     *                           type: boolean
     *       401:
     *         description: Unauthorized
     */
    router.post('/totp/validate', authenticate(), mfaController.verifyTOTP.bind(mfaController));

    /**
     * @swagger
     * /api/{version}/mfa/disable:
     *   post:
     *     summary: Disable MFA
     *     description: Disable Multi-Factor Authentication for the user
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [password]
     *             properties:
     *               password:
     *                 type: string
     *                 description: Current password for confirmation
     *     responses:
     *       200:
     *         description: MFA disabled successfully
     *         content:
     *           application/json:
     *             schema:
     *               $ref: '#/components/schemas/ApiResponse'
     *       400:
     *         description: Invalid password
     *       401:
     *         description: Unauthorized
     */
    router.post('/disable', authenticate(), mfaController.disableMFA.bind(mfaController));

    /**
     * @swagger
     * /api/{version}/mfa/devices:
     *   get:
     *     summary: Get MFA devices
     *     description: List registered MFA devices
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     responses:
     *       200:
     *         description: Devices listed successfully
     *         content:
     *           application/json:
     *             schema:
     *               allOf:
     *                 - $ref: '#/components/schemas/ApiResponse'
     *                 - type: object
     *                   properties:
     *                     data:
     *                       type: array
     *                       items:
     *                         type: object
     *       401:
     *         description: Unauthorized
     */
    router.get('/devices', authenticate(), mfaController.getMFADevices.bind(mfaController));

    // =============================================================================
    // EN: Alias Routes (for backward compatibility)
    // VI: Routes Alias (để tương thích ngược)
    // =============================================================================

    /**
     * @swagger
     * /api/{version}/mfa/setup:
     *   post:
     *     summary: Setup MFA (alias for /totp/enable)
     *     description: Alias endpoint for setting up MFA
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     */
    router.post('/setup', authenticate(), mfaController.enableTOTP.bind(mfaController));

    /**
     * @swagger
     * /api/{version}/mfa/verify:
     *   post:
     *     summary: Verify MFA (alias for /totp/verify)
     *     description: Alias endpoint for verifying MFA code
     *     tags: [MFA]
     *     security:
     *       - bearerAuth: []
     */
    router.post('/verify', authenticate(), mfaController.verifyAndEnableTOTP.bind(mfaController));

    return router;
};
