"""URL registration.

The guard is installed first, as an allowlist: a route added below is protected
by default rather than by someone remembering to protect it. To make a new route
reachable without a session, add its path to PUBLIC_PATHS in endpoints/crud.py
and say in a comment what defends it instead.
"""
from .endpoints.crud import require_session
from .endpoints.oauth import page_google_callback, page_google_start
from .endpoints.session import (
    api_login,
    api_me,
    api_org_select,
    api_password_change,
    page_login,
    page_logout,
)


def init_app(app):
    app.before_request(require_session)

    # pages
    app.add_url_rule("/login", view_func=page_login, methods=["GET"])
    app.add_url_rule("/logout", view_func=page_logout, methods=["GET"])

    # session
    app.add_url_rule("/api/login", view_func=api_login, methods=["POST"])
    app.add_url_rule("/api/me", view_func=api_me, methods=["GET"])
    app.add_url_rule("/api/org/select", view_func=api_org_select, methods=["POST"])
    app.add_url_rule("/api/password", view_func=api_password_change, methods=["POST"])

    # Google sign-in. Both are no-ops redirecting to /login while
    # GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET are unset.
    app.add_url_rule("/auth/google/start", view_func=page_google_start, methods=["GET"])
    app.add_url_rule("/auth/google/callback", view_func=page_google_callback,
                     methods=["GET"])

    # your routes go here