import { Routes } from '@angular/router';
import { authorizationCodeCallbackGuard, noLocalAuthGuard } from '@aurora';

export const routes: Routes = [
  // This route is used as the callback URL for the authorization code flow.
  // It should not be protected by the authentication guard, as it needs to be
  // accessible without authentication to handle the callback from the authentication provider.
  {
    path: 'callback',
    canActivate: [authorizationCodeCallbackGuard],
    children: [],
  },

  { path: '', redirectTo: 'dashboard', pathMatch: 'full' as const },
  {
    // noLocalAuthGuard enforces the configured auth strategy on this entire route group:
    //   - 'password'            → allowed (local sign-in/sign-up forms work normally).
    //   - 'authorization-code' → blocked; browser is sent to the hub launcher so no local
    //                            form ever renders and no Password Grant is attempted.
    path: 'auth',
    canActivate: [noLocalAuthGuard],
    loadChildren: () => import('./domains/auth/routes'),
  },
  // Top-level error page for failed OAuth callback exchanges. Intentionally
  // carries NO authentication guard so it is always reachable as a safe terminal
  // state — preventing the infinite authorize → callback → fail → relaunch loop.
  {
    path: 'callback-error',
    loadComponent: () => import('./domains/auth/callback-error/callback-error.component'),
  },
  // Top-level, unguarded logout: revokes the session server-side, clears local credentials, and
  // redirects to the sign-in page. Reachable regardless of token state (the guard reserves this
  // exact `/sign-out` URL so it is never appended as a post-login redirect target).
  {
    path: 'sign-out',
    loadComponent: () => import('./domains/auth/sign-out/sign-out.component'),
  },
  // Top-level terminal "signed out" page shown after local sign-out in authorization-code mode.
  // Intentionally carries NO authentication guard so it is always reachable as a safe terminal
  // state — preventing the silent re-authentication loop that would occur if the user were sent
  // to /auth/sign-in (gated by noLocalAuthGuard) while the hub cookie is still valid.
  {
    path: 'signed-out',
    loadComponent: () => import('./domains/auth/signed-out/signed-out.component'),
  },
  {
    path: '',
    loadChildren: () => import('./domains/admin/routes'),
  },
];
