'use strict'
var whiteList = [];
var csrf = require('csurf');
module.exports.concatWhiteList = function(arr){
	whiteList = whiteList.concat(arr); 
};
exports.setupRoutes = function(app, requiresLogin, noauth, bearer, noauthBearer){
    var BaseController = require('../').BaseController;
    var autoLayouts = BaseController.getChildControllers(); 
    for (var i = 0; i < autoLayouts.length; i++) {
        var controller = autoLayouts[i];
        app.param(controller.singularName +'Id', controller.load);
        app.get('/' + controller.pluralName + '', noauth, controller.index);
        app.get('/' + controller.pluralName + '/new', requiresLogin, controller.new);
        app.post('/' + controller.pluralName + '', requiresLogin, controller.create);
        app.delete('/' + controller.pluralName + '', requiresLogin, controller.destroyMultiple);
        app.get('/' + controller.pluralName + '/:' + controller.singularName + 'Id', noauth, controller.show);
        app.get('/' + controller.pluralName + '/:' + controller.singularName + 'Id/edit', requiresLogin, controller.edit);
        app.post('/' + controller.pluralName + '/:' + controller.singularName + 'Id', requiresLogin, controller.update);
        app.put('/' + controller.pluralName + '/:' + controller.singularName + 'Id', requiresLogin, controller.update);
        app.delete('/' + controller.pluralName + '/:' + controller.singularName + 'Id', requiresLogin, controller.destroy);
    };

    for (var i = 0; i < autoLayouts.length; i++) {
        var controller = autoLayouts[i];
       // app.param('/API/' + controller.singularName +'Id', controller.loadAPI);
        app.get('/API/' + controller.pluralName + '', noauthBearer, controller.indexAPI);
        app.get('/API/' + controller.pluralName + '/new', bearer, controller.newAPI);
        app.post('/API/' + controller.pluralName + '', bearer, controller.createAPI);
        app.delete('/API/' + controller.pluralName + '', bearer, controller.destroyMultipleAPI);
        app.get('/API/' + controller.pluralName + '/:' + controller.singularName + 'Id', noauthBearer, controller.showAPI);
        app.get('/API/' + controller.pluralName + '/:' + controller.singularName + 'Id/edit', bearer, controller.editAPI);
        app.post('/API/' + controller.pluralName + '/:' + controller.singularName + 'Id', bearer, controller.updateAPI);
        app.put('/API/' + controller.pluralName + '/:' + controller.singularName + 'Id', bearer, controller.updateAPI);
        app.delete('/API/' + controller.pluralName + '/:' + controller.singularName + 'Id', bearer, controller.destroyAPI);
    };

}

exports.conditionalCSRF = function (req, res, next) {
   
    if(process.env.NODE_ENV == "canary"){
        (canaryCsurf)(req, res, function(){
          req.session._csrf = req.csrfToken();

          req.csrf_token = req.csrfToken();
          res.locals.csrf_token = req.csrfToken();
          next()
        });
    }else if (whiteList.indexOf(req.url) !== -1) {
        next();
    }else if (req.url.includes("API")) {
        next();
    } else {
        (csrf())(req, res, function(){
          req.session._csrf = req.csrfToken();

          req.csrf_token = req.csrfToken();
          res.locals.csrf_token = req.csrfToken();
          next()
        });
     
    }
};