/**
 * OIDC Trust Policy routes.
 * Provides endpoints for tenants to register and manage GitHub OIDC trust policies.
 *
 * All routes require Bearer authentication (agents:write scope recommended).
 *
 * Mount this router at `/api/v1/oidc` in app.ts.
 */

import { Router, RequestHandler } from 'express';
import { OIDCTrustPolicyController } from '../controllers/OIDCTrustPolicyController.js';
import { asyncHandler } from '../utils/asyncHandler.js';

/**
 * Creates and returns the Express router for OIDC trust policy endpoints.
 *
 * @param controller - The OIDC trust policy controller instance.
 * @param authMiddleware - The JWT authentication middleware for protected endpoints.
 * @returns Configured Express router.
 */
export function createOIDCTrustPoliciesRouter(
  controller: OIDCTrustPolicyController,
  authMiddleware: RequestHandler,
): Router {
  const router = Router();

  // POST /oidc/trust-policies — register a new trust policy (authenticated)
  router.post(
    '/trust-policies',
    authMiddleware,
    asyncHandler(controller.createTrustPolicy.bind(controller)),
  );

  // GET /oidc/trust-policies?agentId=<uuid> — list trust policies for an agent (authenticated)
  router.get(
    '/trust-policies',
    authMiddleware,
    asyncHandler(controller.listTrustPolicies.bind(controller)),
  );

  // DELETE /oidc/trust-policies/:id — delete a trust policy (authenticated)
  router.delete(
    '/trust-policies/:id',
    authMiddleware,
    asyncHandler(controller.deleteTrustPolicy.bind(controller)),
  );

  return router;
}
