const express = require('express');
const router = express.Router();
const usersController = require('../controllers/usersController');
const { verifyToken, verifyUserToken, verifyPortalKey } = require('../middleware/auth');

// Captive portal — requer X-Portal-Key
router.post('/lead',          verifyPortalKey, usersController.receiveLead);
router.post('/portal/check',  verifyPortalKey, usersController.checkPortalUser);
router.post('/login',                   usersController.loginUser);
router.post('/register',                usersController.registerUser);
router.post('/activate',                usersController.activateUser);
router.post('/auth/forgot-password',    usersController.forgotPassword);
router.post('/auth/reset-password',     usersController.resetPassword);
router.post('/auth/migrate',            usersController.migrateAccount);

// User — autenticado
router.get('/me',              verifyUserToken, usersController.getMe);
router.patch('/me',            verifyUserToken, usersController.updateMe);
router.patch('/me/optin',      verifyUserToken, usersController.updateOptin);

// --- Phase 5: Ganhadores ---
router.get('/my-notifications', verifyUserToken, usersController.getMyNotifications);
router.put('/my-notifications/:id/read', verifyUserToken, usersController.markNotificationRead);
router.get('/my-claims', verifyUserToken, usersController.getMyClaims);
router.post('/my-claims', verifyUserToken, usersController.createClaim);

// Admin routes
router.get('/users', verifyToken, usersController.getAll);
router.get('/users/stats', verifyToken, usersController.getStats);
router.put('/users/:id', verifyToken, usersController.updateUser);
router.delete('/users/:id', verifyToken, usersController.deleteUser);

module.exports = router;
