# Public authentication routes (NOT under /api, so the guard does not gate them).

# `%||%` fallback so this router is self-contained.
`%||%` <- function(x, y) if (is.null(x)) y else x

#* Login: verify credentials, issue the JWT cookie.
#*
#* Logs via `server$log()` (a reserved handler argument) so events are picked up
#* by the OpenTelemetry logger when telemetry is on. Prefer this over cat()/print().
#* @post /auth/login
#* @parser json
#* @serializer json
function(request, response, body = NULL, server) {
  user <- body$user %||% ""
  pass <- body$pass %||% ""

  u <- find_user(user)
  ok <- !is.null(u) &&
    tryCatch(sodium::password_verify(u$hash, pass), error = function(e) FALSE)

  if (!isTRUE(ok)) {
    server$log("message", paste("login denied for", user))
    response$status <- 401L
    return(list(error = "Usuário ou senha inválidos."))
  }
  server$log("message", paste("login ok for", u$name))

  token <- aurora::aurora_jwt_token(auth, list(
    user       = u$name,
    secretaria = u$secretaria
  ))
  aurora::aurora_set_auth_cookie(auth, response, token, secure = secure_cookies)

  list(user = u$name, secretaria = u$secretaria)
}

#* Logout: clear the auth cookie.
#* @post /auth/logout
#* @serializer json
function(response) {
  aurora::aurora_clear_auth_cookie(auth, response, secure = secure_cookies)
  list(status = "ok")
}
