package api

import (
	"database/sql"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

func NewRouter(db *sql.DB) http.Handler {
	r := chi.NewRouter()
	r.Use(middleware.Logger)
	r.Use(middleware.Recoverer)

	r.Get("/healthz", func(w http.ResponseWriter, r *http.Request) {
		respond(w, http.StatusOK, map[string]string{"status": "ok"})
	})

	// Unauthenticated: bootstrap and Alertmanager webhook receiver.
	r.Post("/api/bootstrap", handleBootstrap(db))
	r.Post("/api/alertmanager/webhook", handleAlertmanagerWebhook(db))

	// All other /api routes require a valid API key.
	r.Group(func(r chi.Router) {
		r.Use(AuthMiddleware(db))

		r.Get("/api/users", handleListUsers(db))
		r.Post("/api/users", handleCreateUser(db))
		r.Delete("/api/users/{id}", handleDeleteUser(db))
		r.Post("/api/users/{id}/api-keys", handleCreateAPIKey(db))
		r.Delete("/api/users/{id}/api-keys/{keyID}", handleDeleteAPIKey(db))

		r.Get("/api/alerts", handleListAlerts(db))
		r.Get("/api/alerts/{id}", handleGetAlert(db))
		r.Post("/api/alerts/{id}/acknowledge", handleAcknowledge(db))
		r.Delete("/api/alerts/{id}/acknowledge", handleUnacknowledge(db))
		r.Post("/api/alerts/{id}/archive", handleArchive(db))
		r.Delete("/api/alerts/{id}/archive", handleUnarchive(db))
		r.Get("/api/alerts/{id}/comments", handleListComments(db))
		r.Post("/api/alerts/{id}/comments", handleCreateComment(db))
		r.Delete("/api/alerts/{id}/comments/{commentID}", handleDeleteComment(db))

		r.Post("/api/schedule", handleCreateSchedule(db))
		r.Get("/api/schedule/current", handleCurrentSchedule(db)) // must be before /{id}
		r.Get("/api/schedule", handleListSchedule(db))
		r.Delete("/api/schedule/{id}", handleDeleteSchedule(db))

		r.Get("/api/stats/alerts", handleStatsAlerts(db))
		r.Get("/api/stats/alerts/top", handleStatsTop(db))
		r.Get("/api/stats/alerts/by-hour", handleStatsByHour(db))
		r.Get("/api/stats/alerts/by-day", handleStatsByDay(db))
	})

	return r
}