package quizzes

import (
	"git.golem15.com/golem15/sm-quizzes-plugin/controllers/api"
	"git.golem15.com/golem15/summercms/modules/pact"
	"git.golem15.com/golem15/summercms/modules/surf"
)

var _ pact.HasRoutes = (*Plugin)(nil)

// ManagePrefix is the path prefix of the management API.
const ManagePrefix = "/api/v1/quizzes"

// permQuizzes is the permission that lets a user manage quizzes, in the
// admin and through the management API.
const permQuizzes = "golem15.quizzes.access_quizzes"

// Routes mounts the quiz API under /_quizzes/api/v1 behind golem15.user's
// jwt.auth middleware, and the management API under /api/v1/quizzes behind
// its application-wide API token.
func (p *Plugin) Routes(r pact.Router) error {
	h := api.New(p.app)
	r.Group("/_quizzes/api/v1", surf.Use("jwt.auth"), func(g pact.Router) {
		g.Get("/quizzes", h.ListQuizzes)
		g.Get("/quizzes/{slug}", h.ShowQuiz)
		g.Where("slug", `[a-z0-9-]+`)
		g.Post("/quizzes/{slug}/attempts", h.StartAttempt)
		g.Where("slug", `[a-z0-9-]+`)
		g.Get("/attempts", h.ListAttempts)
		g.Get("/attempts/{id}", h.ShowAttempt)
		g.Where("id", `[0-9]+`)
		g.Post("/attempts/{id}/answers", h.Answer)
		g.Where("id", `[0-9]+`)
		g.Post("/attempts/{id}/finish", h.Finish)
		g.Where("id", `[0-9]+`)
	})
	// quizzes:import over HTTP. The token's scope limits delegation;
	// user.permission checks the owner's current group permissions.
	r.Group(ManagePrefix, surf.Use("throttle:60,1", "user.api_token"), func(g pact.Router) {
		g.Post("/import", h.ImportQuiz, "user.scope:write", "user.permission:"+permQuizzes)
	})
	return nil
}