defmodule PaymentGatewayAppWeb.Router do
  use PaymentGatewayAppWeb, :router

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_live_flash
    plug :put_root_layout, html: {PaymentGatewayAppWeb.Layouts, :root}
    plug :protect_from_forgery
    plug :put_secure_browser_headers
  end

  pipeline :public do
    plug :accepts, ["html", "js"]
    plug :fetch_session
    plug :put_secure_browser_headers
  end

  # Plain HTML payment pages rendered inside iframe. Avoid secure browser
  # headers here because x-frame-options: SAMEORIGIN blocks merchant embeds.
  pipeline :embedded_payment do
    plug :accepts, ["html"]
    plug :fetch_session
  end

  # LiveView-capable pipeline for payment pages served inside merchant iframes.
  # NOTE: put_secure_browser_headers is intentionally omitted — it adds
  # x-frame-options: SAMEORIGIN which would block cross-origin iframe embedding.
  pipeline :live_payment do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_live_flash
    plug :put_root_layout, html: {PaymentGatewayAppWeb.Layouts, :root}
    plug :protect_from_forgery  # generates CSRF token needed by LiveSocket
  end

  pipeline :api do
    plug :accepts, ["json"]
  end

  scope "/", PaymentGatewayAppWeb do
    pipe_through :public

    get "/shukria-payment-widget.js", PageController, :widget
    # Entry point: decodes token, redirects to appropriate LiveView (/sandbox or /gateway)
    get "/", PageController, :iframe
    post "/", PageController, :iframe
    get "/demo", PageController, :demo
  end

  # Payment pages (plain HEEX + JavaScript) served inside merchant iframes.
  scope "/", PaymentGatewayAppWeb do
    pipe_through :embedded_payment

    get "/sandbox", PageController, :sandbox
    get "/gateway", PageController, :gateway
  end

  # Payment middleware endpoint (no CSRF protection for NAR POST)
  scope "/", PaymentGatewayAppWeb do
    pipe_through :embedded_payment

    post "/process", PaymentMiddlewareController, :process
  end

  # Payment redirect preparation endpoint (no CSRF for widget calls)
  scope "/", PaymentGatewayAppWeb do
    pipe_through :embedded_payment

    post "/prepare-redirect", PageController, :prepare_redirect
  end

  scope "/", PaymentGatewayAppWeb do
    pipe_through :browser

    get "/iframe", PageController, :iframe
    post "/iframe", PageController, :iframe
    post "/callback", PageController, :callback
    live "/live_initiate", PaymentLive.Initiate, :new
    live "/status/:payment_id", PaymentLive.Status, :show
  end

  # API routes for payment operations
  scope "/api", PaymentGatewayAppWeb do
    pipe_through :api

    post "/initiate", PaymentController, :create
    get "/status/:payment_id", PaymentController, :status
    post "/checksum", PageController, :checksum
  end
end