const express = require('express');
const router = express.Router();
const { body } = require('express-validator');
const { validate } = require('../middleware/validation');
const { authenticate } = require('../middleware/auth');
const profileController = require('../controllers/profileController');
router.get('/overview', authenticate, profileController.getSecurityOverview);

router.put(
  '/password',
  authenticate,
  [
    body('currentPassword')
      .notEmpty()
      .withMessage('Current password is required'),
    body('newPassword')
      .isLength({ min: 8 })
      .withMessage('Password must be at least 8 characters')
      .matches(/[A-Z]/)
      .withMessage('Must include one uppercase letter')
      .matches(/[a-z]/)
      .withMessage('Must include one lowercase letter')
      .matches(/[0-9]/)
      .withMessage('Must include one number')
      .matches(/[!@#$%^&*]/)
      .withMessage('Must include one special character (!@#$%^&*)'),
    body('confirmPassword')
      .custom((value, { req }) => value === req.body.newPassword)
      .withMessage('Passwords do not match'),
  ],
  validate,
  profileController.changePassword
);

router.put(
  '/pin',
  authenticate,
  [
    body('currentPin')
      .notEmpty()
      .withMessage('Current pin is required'),
    body('newPin')
      .isInt({ min: 4 })
      .withMessage('Pin must 4 characters'),
    body('confirmPin')
      .custom((value, { req }) => value === req.body.newPin)
      .withMessage('Pins do not match'),
  ],
  validate,
  profileController.changePin
);

router.post(
  '/2fa/validate-password',
  authenticate,
  [
    body('password').isString().withMessage('Password must be 6 provided'),
    body('type').isIn(['email' , 'authenticator']).withMessage('Please select your type')
  ],
  validate,
  profileController.verifyPassword2fa
);

router.post(
  '/2fa/enable',
  authenticate,
  [
    body('code')
      .matches(/^\d{6}$/)
      .withMessage('Code must be 6 digits'),
  ],
  validate,
  profileController.enable2FA
);

router.post(
  '/2fa/disable',
  authenticate,
  profileController.disable2FA
);

router.post(
  '/2fa/resend',
  authenticate,
  validate,
  profileController.resend2fa
);

router.post(
  '/2fa/backup-codes/regenerate',
  authenticate,
  profileController.regenerateBackupCodes
);

router.put(
  '/anti-phishing',
  authenticate,
  [
    body('antiPhishingEnabled')
      .isBoolean()
      .withMessage('antiPhishingEnabled must be boolean'),
    body('antiPhishingCode')
      .trim()
      .isLength({ min: 4, max: 32 })
      .withMessage('Anti-phishing code must be 4-32 characters'),
  ],
  validate,
  profileController.updateAntiPhishing
);

router.put(
  '/withdrawal-whitelist',
  authenticate,
  [
    body('withdrawalWhitelist')
      .isBoolean()
      .withMessage('withdrawalWhitelist must be boolean'),
  ],
  validate,
  profileController.updateWithdrawalWhitelist
);

router.put(
  '/login-type',
  authenticate,
  [
    body('currentPassword')
      .notEmpty()
      .withMessage('Current password is required'),
    body('loginW')
      .isIn(['password' , 'pin'])
      .withMessage('login Type must either be pin or password'),
  ],
  validate,
  profileController.updateLoginType
);

router.put(
  '/login-notifications',
  authenticate,
  [
    body('loginNotifications')
      .isBoolean()
      .withMessage('loginNotifications must be boolean'),
  ],
  validate,
  profileController.updateLoginNotifications
);

router.post(
  '/sessions/revoke',
  authenticate,
  [
    body('sessionId')
      .notEmpty()
      .withMessage('sessionId is required'),
  ],
  validate,
  profileController.revokeSessionByBody
);

router.post(
  '/sessions/revoke-all',
  authenticate,
  profileController.revokeAllSessions
);

module.exports = router