package com.honey.honey.config;

import com.honey.honey.security.AuthInterceptor;
import com.honey.honey.security.RateLimitInterceptor;
import com.honey.honey.security.UserRateLimitInterceptor;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@RequiredArgsConstructor
public class WebConfig implements WebMvcConfigurer {

    private final AuthInterceptor authInterceptor;
    private final RateLimitInterceptor rateLimitInterceptor;
    private final UserRateLimitInterceptor userRateLimitInterceptor;

    @Override
    public void addInterceptors(org.springframework.web.servlet.config.annotation.InterceptorRegistry registry) {
        // NOTE: Rate limiting is NOT applied to Telegram webhook endpoint
        // Telegram sends webhooks from multiple IPs and we need to process all updates, especially payments
        // Rate limiting interceptor is only for bot registration endpoint (if needed elsewhere)
        
        // User session interceptor for all other authenticated endpoints
        registry.addInterceptor(authInterceptor)
                .excludePathPatterns(
                    "/ping",
                    "/actuator/**",
                    "/api/auth/tma/session", // Session creation endpoint doesn't require auth
                    "/api/telegram/webhook/**", // Telegram webhook (token in path, validated in controller)
                    "/avatars/**", // Avatar static files don't require auth (served by Nginx in production)
                    "/api/check_user/**", // User check endpoint for external applications (open endpoint)
                    "/api/deposit_webhook/**", // 3rd party deposit completion webhook (token in path, no auth)
                    "/api/notify_broadcast/**", // Notify broadcast start/stop (token in path, no auth)
                    "/api/admin/**", // Admin endpoints are handled by Spring Security
                    // Swagger / OpenAPI docs (no auth required for documentation)
                    "/swagger-ui/**",
                    "/swagger-ui.html",
                    "/v3/api-docs",
                    "/v3/api-docs/**",
                    "/webjars/**",
                    "/swagger-resources/**",
                    "/configuration/**",
                    // Same under /api/ when Swagger is proxied at a secret path (e.g. nginx rewrite to /api/swagger-ui/)
                    "/api/swagger-ui/**",
                    "/api/swagger-ui.html",
                    "/api/v3/api-docs",
                    "/api/v3/api-docs/**",
                    "/api/webjars/**",
                    "/api/swagger-resources/**",
                    "/api/configuration/**"
                );
        
        // User-based rate limiting for payment creation and payout creation (applied after auth interceptor)
        registry.addInterceptor(userRateLimitInterceptor)
                .addPathPatterns("/api/payments/create", "/api/payouts");
    }
}

