import { Router } from 'express'

import { createRateLimitMiddleware, getBodyFieldRateLimitKey } from '../middleware/rate-limit.js'
import {
  authorizeAdminDevice,
  getAdminDeviceChallengeStatus,
} from '../services/admin/admin-device-auth-service.js'
import { buildSuccessPayload, sendRouteError } from '../utils/http.js'

const router = Router()

const authorizeRateLimit = createRateLimitMiddleware({
  scope: 'admin:device:authorize',
  windowMs: 60_000,
  max: 30,
  key: getBodyFieldRateLimitKey('challengeId'),
})

router.post('/authorize', authorizeRateLimit, async (req, res) => {
  try {
    await authorizeAdminDevice((req.body || {}) as Record<string, unknown>)
    res.json(buildSuccessPayload({ authorized: true }, '设备已确认'))
  } catch (error) {
    sendRouteError(res, error, '设备确认失败', '[dcauth/authorize]')
  }
})

router.get('/challenge/:challengeId/status', async (req, res) => {
  try {
    const pollToken = String(req.headers['x-poll-token'] || req.query.pollToken || '').trim()
    const data = await getAdminDeviceChallengeStatus(req.params.challengeId, pollToken)
    res.json(buildSuccessPayload(data, 'ok'))
  } catch (error) {
    sendRouteError(res, error, '读取设备认证状态失败', '[dcauth/status]')
  }
})

export default router