/**
 * DID routes for SentryAgent.ai AgentIdP.
 * Wires DIDController handlers to Express paths.
 *
 * Agent-level DID routes (mounted at /api/v1):
 *   GET /agents/:agentId/did         — no auth
 *   GET /agents/:agentId/did/resolve — auth + OPA
 *   GET /agents/:agentId/did/card    — no auth
 *
 * The instance-level well-known route (GET /.well-known/did.json) is registered
 * directly on the Express app in app.ts, not through this router.
 */

import { Router, RequestHandler } from 'express';
import { DIDController } from '../controllers/DIDController.js';
import { asyncHandler } from '../utils/asyncHandler.js';

/**
 * Creates and returns the Express router for agent-level DID endpoints.
 * Mount this router at `/api/v1` in app.ts.
 *
 * @param controller - The DID controller instance.
 * @param authMiddleware - The JWT authentication middleware.
 * @param opaMiddleware - The OPA authorization middleware.
 * @returns Configured Express router.
 */
export function createDIDRouter(
  controller: DIDController,
  authMiddleware: RequestHandler,
  opaMiddleware: RequestHandler,
): Router {
  const router = Router({ mergeParams: true });

  // GET /agents/:agentId/did — unauthenticated
  router.get(
    '/agents/:agentId/did',
    asyncHandler(controller.getAgentDIDDocument.bind(controller)),
  );

  // GET /agents/:agentId/did/resolve — requires auth + OPA
  router.get(
    '/agents/:agentId/did/resolve',
    authMiddleware,
    opaMiddleware,
    asyncHandler(controller.resolveAgentDID.bind(controller)),
  );

  // GET /agents/:agentId/did/card — unauthenticated
  router.get(
    '/agents/:agentId/did/card',
    asyncHandler(controller.getAgentCard.bind(controller)),
  );

  return router;
}
