import { Router } from 'express';
import {
  register,
  login,
  refreshToken,
  logout,
  changePassword,
  getProfile,
  updateProfile,
} from '../controllers/authController';
import { authenticate } from '../middlewares/auth';
import { 
  blockBotsOnAuth, 
  requireRefreshToken 
} from '../middlewares/botDetection';
import {
  refreshTokenRateLimiter,
  loginRateLimiter,
  registerRateLimiter,
  authGeneralRateLimiter,
} from '../middlewares/authRateLimiter';

const router = Router();

// Aplicar rate limiting general a todas las rutas de autenticación
router.use(authGeneralRateLimiter);

/**
 * @route   POST /api/auth/register
 * @desc    Register a new user
 * @access  Public
 */
router.post('/register', registerRateLimiter, blockBotsOnAuth, register);

/**
 * @route   POST /api/auth/login
 * @desc    Login user
 * @access  Public
 */
router.post('/login', loginRateLimiter, blockBotsOnAuth, login);

/**
 * @route   POST /api/auth/refresh
 * @desc    Refresh access token
 * @access  Public (requires refresh token)
 * @note    Protected with aggressive rate limiting and bot detection
 */
router.post('/refresh', refreshTokenRateLimiter, blockBotsOnAuth, requireRefreshToken, refreshToken);

/**
 * @route   POST /api/auth/logout
 * @desc    Logout user
 * @access  Private
 */
router.post('/logout', authenticate, logout);

/**
 * @route   POST /api/auth/change-password
 * @desc    Change user password
 * @access  Private
 */
router.post('/change-password', authenticate, changePassword);

/**
 * @route   GET /api/auth/profile
 * @desc    Get current user profile
 * @access  Private
 */
router.get('/profile', authenticate, getProfile);

/**
 * @route   PUT /api/auth/profile
 * @desc    Update current user profile
 * @access  Private
 */
router.put('/profile', authenticate, updateProfile);

export default router;