import { Router } from 'express';
import type { DatabaseSync } from 'node:sqlite';
import type { EventEmitter } from 'node:events';
import { ensureCsrf, requireCsrf } from '../middleware/csrf.ts';
import { createAuthRouter } from './auth.ts';
import { createSubscriptionsRouter } from './subscriptions.ts';
import { createItemsRouter } from './items.ts';
import { createStreamRouter } from './stream.ts';
import { bus as defaultBus } from '../events.ts';
import type { BusEvents } from '../events.ts';
import type { UrlGuard } from '../services/ingest.ts';

export function createApiRouter(
  db: DatabaseSync,
  guard?: UrlGuard,
  bus: EventEmitter<BusEvents> = defaultBus,
): Router {
  const router = Router();
  router.use(ensureCsrf);
  router.get('/csrf', (req, res) => res.json({ token: req.csrfToken?.() }));
  router.use('/auth', createAuthRouter(db));
  // CSRF protection for state-changing routes
  router.use(requireCsrf);
  router.use('/subscriptions', createSubscriptionsRouter(db, guard));
  router.use('/items', createItemsRouter(db));
  router.use('/stream', createStreamRouter(db, bus));
  return router;
}