from django.urls import path
from rest_framework_simplejwt.views import TokenRefreshView

from . import api_views, oauth_views

app_name = 'users'

# Mounted at `api/auth/` in backend/urls.py.
#
# `POST /api/token/refresh/` is NOT here — it is routed at the project level,
# because that exact path is what lib/apiClient.js already calls.

urlpatterns = [
    path('login/', api_views.login, name='login'),
    path('register/', api_views.register, name='register'),
    path('activate/', api_views.activate, name='activate'),
    # Email links. `confirm` on both is AllowAny: the link is opened in
    # whatever browser the inbox is on, which is rarely the signed-in one.
    path('verify-email/request/', api_views.verify_email_request, name='verify-email-request'),
    path('verify-email/confirm/', api_views.verify_email_confirm, name='verify-email-confirm'),
    path('password-reset/request/', api_views.password_reset_request, name='password-reset-request'),
    path('password-reset/confirm/', api_views.password_reset_confirm, name='password-reset-confirm'),

    # `authorize` mints the code for a caller holding a JWT (the website),
    # `token` exchanges it for tokens. The browser flow in `views.py` mints
    # from a session instead and does not use the first of these.
    path('desktop/authorize/', api_views.desktop_authorize, name='desktop-authorize'),
    path('desktop/token/', api_views.desktop_token, name='desktop-token'),

    # The PWA's sibling of `desktop/authorize/` — no PKCE, see the docstring.
    path('handoff/', api_views.pwa_handoff, name='pwa-handoff'),

    path('logout/', api_views.logout, name='logout'),
    path('me/', api_views.MeView.as_view(), name='me'),

    # Social sign-in. The first two are browser redirects and return HTML or a
    # `Location` header; only the exchange is JSON.
    path('oauth/providers/', api_views.oauth_providers, name='oauth-providers'),
    path('oauth/exchange/', api_views.oauth_exchange, name='oauth-exchange'),
    path('oauth/<str:provider>/start/', oauth_views.oauth_start, name='oauth-start'),
    path('oauth/<str:provider>/callback/', oauth_views.oauth_callback, name='oauth-callback'),
]