const express = require('express');
const router = express.Router();
const rateLimit = require('express-rate-limit');
const ContactController = require('../controllers/contactController');
const { authenticateToken, authorizePermission } = require('../middleware/auth');
const { createContactValidation, updateContactValidation } = require('../middleware/contactValidation');
const { createOptionalImageUploadMiddleware } = require('../middleware/fileUpload');
// Rate limiting: separate read vs write to avoid blocking Directory
const readLimiter = rateLimit({
    windowMs: 60 * 1000,
    max: 600,
    message: {
        status: 'error',
        message: 'Rate limit exceeded for reading contacts. Please wait a moment and try again.',
        retryAfter: 60
    },
    standardHeaders: true,
    legacyHeaders: false,
    keyGenerator: (req) => `${req.user?.id || req.ip}-read`
});
const writeLimiter = rateLimit({
    windowMs: 60 * 1000,
    max: 20,
    message: {
        status: 'error',
        message: 'Too many contact operations. Please wait a moment and try again.',
        retryAfter: 60
    },
    standardHeaders: true,
    legacyHeaders: false,
    keyGenerator: (req) => `${req.user?.id || req.ip}-write`
});
// All routes require authentication
router.use(authenticateToken);
const ensureContactsSource = (req, res, next) => {
    if (!req.query.source)
        req.query.source = 'contacts';
    next();
};
// GET /api/contacts - Get all contacts with tree structure
router.get('/', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getAllContacts);
// GET /api/contacts/search - Search contacts
router.get('/search', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.searchContacts);
// GET /api/contacts/statistics - Get contact statistics
router.get('/statistics', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactStatistics);
// GET /api/contacts/organizational-hierarchy - Get organizational hierarchy
router.get('/organizational-hierarchy', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getOrganizationalHierarchy);
// GET /api/contacts/unit/:unitId - Get contact tree by unit
router.get('/unit/:unitId', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactTreeByUnit);
// GET /api/contacts/department/:departmentId - Get contact tree by department
router.get('/department/:departmentId', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactTreeByDepartment);
// GET /api/contacts/branch/:branchId - Get contact tree by branch (deprecated, use department)
router.get('/branch/:branchId', ensureContactsSource, ContactController.getContactTreeByBranch);
// GET /api/contacts/:id - Get contact by ID
router.get('/:id', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactById);
// GET /api/contacts/:id/children - Get contact children
router.get('/:id/children', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactChildren);
// GET /api/contacts/:id/hierarchy - Get full hierarchy path for a contact
router.get('/:id/hierarchy', authorizePermission('contact.read'), readLimiter, ensureContactsSource, ContactController.getContactHierarchy);
// POST /api/contacts - Create new contact
router.post('/', authorizePermission('contact.create'), writeLimiter, createOptionalImageUploadMiddleware('logo', 'contacts'), // Logo upload middleware
createContactValidation, ContactController.createContact);
// PUT /api/contacts/:id - Update contact
router.put('/:id', authorizePermission('contact.update'), writeLimiter, createOptionalImageUploadMiddleware('logo', 'contacts'), // Logo upload middleware
updateContactValidation, ContactController.updateContact);
// DELETE /api/contacts/:id - Delete contact
router.delete('/:id', authorizePermission('contact.delete'), writeLimiter, ContactController.deleteContact);
// PUT /api/contacts/:id/change-password - Change contact password
router.put('/:id/change-password', authorizePermission('contact.update'), writeLimiter, ContactController.changePassword);
module.exports = router;
//# sourceMappingURL=contacts.js.map