package feedback

import (
	"git.golem15.com/golem15/sm-feedback-plugin/controllers/api"
	"git.golem15.com/golem15/summercms/modules/pact"
	"git.golem15.com/golem15/summercms/modules/surf"
)

// Routes mounts the widget API. The public group has no auth: the widget
// key in the path and the Origin allow-list are its gate, backed by the
// per-IP buckets. CORS preflights (OPTIONS) on _feedback/api/* are answered
// by surf's path-scoped CORS layer, which the application's http.cors.paths
// must list, so no OPTIONS route is registered. A second group on the same
// prefix carries the per-user preference behind golem15.user's jwt.auth.
func (p *Plugin) Routes(r pact.Router) error {
	r.Group("/_feedback/api/v1", nil, func(g pact.Router) {
		g.Get("/{key}/config", api.Config(p.app), "throttle:"+BucketConfig)
		g.Post("/{key}/submit", api.Submit(p.app), "throttle:"+BucketSubmit)
	})
	r.Group("/_feedback/api/v1", surf.Use("jwt.auth"), func(g pact.Router) {
		g.Put("/me/hidden", api.MeHidden(p.app))
	})
	// The widget script, at the path of the WinterCMS plugin's file.
	r.Get(EmbedJSPath, EmbedJS())
	return nil
}