package main

import (
	"net/http"

	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
)

// mountREST registers the REST API on its own mux and mounts it at "/" behind
// auth (hyperguild#149). Authentication is a property of the mux, not of each
// route: anything not registered on the outer mux as explicitly public (/mcp,
// /capture, the HMAC webhook, OAuth metadata, /metrics) lands here and is
// authenticated, including routes added later. Before this, only /mcp was
// wrapped, and the REST routes beside it were open; infra#517 found them on
// the internet.
func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.Handler) {
	rest := http.NewServeMux()
	rest.HandleFunc("POST /query", h.Query)
	rest.HandleFunc("POST /write", h.Write)
	rest.HandleFunc("POST /index", h.Index)
	rest.HandleFunc("POST /ingest", h.Ingest)
	rest.HandleFunc("POST /ingest-path", h.IngestPath)
	rest.HandleFunc("POST /ingest-raw", h.IngestRaw)
	rest.HandleFunc("POST /backfill-refs", h.BackfillRefs)
	rest.HandleFunc("GET /pending", h.Pending)
	rest.HandleFunc("POST /promote", h.Promote)
	rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
	rest.HandleFunc("GET /pass-rate", h.PassRate)
	mux.Handle("/", auth(rest))
}