<?php

declare(strict_types=1);

use BotGuard\Controllers\Api\ChallengeApiController;
use BotGuard\Controllers\Api\V1Controller;
use BotGuard\Controllers\Api\VerificationApiController;
use BotGuard\Core\Router;

/**
 * JSON API routes.
 *
 * The verification endpoint receives the client-collected signal bundle, runs
 * the detection engine and returns a decision (redirect target or block). It is
 * CSRF-protected and rate-limited like any state-changing endpoint.
 */
return static function (Router $router): void {
    $router->group(['prefix' => '/api'], static function (Router $r): void {
        // Issues a fresh puzzle challenge for the verification page.
        $r->get('/challenge', ChallengeApiController::class . '@issue', ['throttle']);

        // Receives collected signals -> scores -> returns decision.
        $r->post('/verify', VerificationApiController::class . '@verify', ['csrf', 'throttle']);

        // Public REST API (v1), authenticated by API key (no CSRF; not browser-driven).
        $r->group(['prefix' => '/v1', 'middleware' => ['apikey', 'throttle']], static function (Router $v): void {
            $v->get('/stats', V1Controller::class . '@stats');
            $v->get('/results', V1Controller::class . '@results');
        });
    });
};
