from django.urls import path

from . import views

app_name = 'auth-browser'

# Mounted at `auth/` — HTML, session cookies, CSRF on. Deliberately outside
# `api/`, where CORS is wide open and CSRF does not apply.

urlpatterns = [
    # Ordered most-specific-first to match core.middleware's rate limiter,
    # which returns the FIRST matching prefix rather than the longest.
    path('desktop/register/', views.desktop_register, name='desktop-register'),
    path('desktop/done/', views.desktop_done, name='desktop-done'),
    path('desktop/', views.desktop_sign_in, name='desktop-sign-in'),
]