import { serve } from '@hono/node-server'
import { serveStatic } from '@hono/node-server/serve-static'
import { Hono } from 'hono'
import { healthRouter } from './routes/health.js'
import { meRouter } from './routes/me.js'
import { oidcAuthMiddleware, processOAuthCallback } from './auth/middleware.js'

export const app = new Hono()

// GET /health — unauthenticated, mounted BEFORE the OIDC guard (T-01-03, T-02-05)
app.route('/health', healthRouter)

// OIDC callback — must be registered BEFORE oidcAuthMiddleware so the
// authorization-code exchange is not itself intercepted by the auth check (T-02-02)
app.get('/callback', (c) => processOAuthCallback(c))

// Protect all /api/* routes with OIDC session middleware (AUTH-01, T-02-05).
// Unauthenticated requests receive a 302 redirect to Authelia's authorize endpoint.
// OIDC_AUTH_EXTERNAL_URL is MANDATORY behind Pangolin to construct the correct
// redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
app.use('/api/*', oidcAuthMiddleware())

// Protected API routes
app.route('/api/me', meRouter)

// Serve React PWA static assets from ./public (Vite build output)
app.use('/assets/*', serveStatic({ root: './public' }))
app.get('*', serveStatic({ path: './public/index.html' }))

// Only start the HTTP server when this module is run directly (not imported in tests)
if (process.argv[1] && import.meta.url.endsWith(process.argv[1].replace(/^.*\//, ''))) {
  serve({ fetch: app.fetch, port: 3000 }, (info) => {
    console.log(`FamilySync API running on http://localhost:${info.port}`)
  })
}