routes.go

package main

import (
	"ambient-code-backend/handlers"
	"ambient-code-backend/websocket"

	"github.com/gin-gonic/gin"
)

func registerRoutes(r *gin.Engine) {
	// API routes
	api := r.Group("/api")
	{
		// Public endpoints (no auth required)
		api.GET("/workflows/ootb", handlers.ListOOTBWorkflows)
		// Global runner-types endpoint (no workspace overrides — for admin pages)
		api.GET("/runner-types", handlers.GetRunnerTypesGlobal)

		api.POST("/projects/:projectName/agentic-sessions/:sessionName/github/token", handlers.MintSessionGitHubToken)

		// Runner-accessible feedback endpoint — accepts service account tokens
		// (BOT_TOKEN) so that in-session workflows (e.g. Amber) can submit
		// feedback without requiring a user OAuth token.  The handler performs
		// its own auth via GetK8sClientsForRequest + SSAR check.
		api.POST("/projects/:projectName/agentic-sessions/:sessionName/runner/feedback", websocket.HandleAGUIFeedback)

		projectGroup := api.Group("/projects/:projectName", handlers.ValidateProjectContext())
		{
			projectGroup.GET("/models", handlers.ListModelsForProject)
			projectGroup.GET("/runner-types", handlers.GetRunnerTypes)
			projectGroup.GET("/access", handlers.AccessCheck)
			projectGroup.GET("/integration-status", handlers.GetProjectIntegrationStatus)
			projectGroup.GET("/users/forks", handlers.ListUserForks)
			projectGroup.POST("/users/forks", handlers.CreateUserFork)

			projectGroup.GET("/repo/tree", handlers.GetRepoTree)
			projectGroup.GET("/repo/blob", handlers.GetRepoBlob)
			projectGroup.GET("/repo/branches", handlers.ListRepoBranches)
			projectGroup.GET("/repo/seed-status", handlers.GetRepoSeedStatus)
			projectGroup.POST("/repo/seed", handlers.SeedRepositoryEndpoint)

			projectGroup.GET("/agentic-sessions", handlers.ListSessions)
			projectGroup.POST("/agentic-sessions", handlers.CreateSession)
			projectGroup.GET("/agentic-sessions/:sessionName", handlers.GetSession)
			projectGroup.PUT("/agentic-sessions/:sessionName", handlers.UpdateSession)
			projectGroup.PATCH("/agentic-sessions/:sessionName", handlers.PatchSession)
			projectGroup.DELETE("/agentic-sessions/:sessionName", handlers.DeleteSession)
			projectGroup.POST("/agentic-sessions/:sessionName/clone", handlers.CloneSession)
			projectGroup.POST("/agentic-sessions/:sessionName/start", handlers.StartSession)
			projectGroup.POST("/agentic-sessions/:sessionName/stop", handlers.StopSession)
			projectGroup.GET("/agentic-sessions/:sessionName/workspace", handlers.ListSessionWorkspace)
			projectGroup.GET("/agentic-sessions/:sessionName/workspace/*path", handlers.GetSessionWorkspaceFile)
			projectGroup.PUT("/agentic-sessions/:sessionName/workspace/*path", handlers.PutSessionWorkspaceFile)
			projectGroup.DELETE("/agentic-sessions/:sessionName/workspace/*path", handlers.DeleteSessionWorkspaceFile)
			// Pre-upload: write files to S3 before session pod starts (hydrate.sh seeds them)
			projectGroup.GET("/agentic-sessions/:sessionName/file-uploads", handlers.ListPreUploadedFiles)
			projectGroup.PUT("/agentic-sessions/:sessionName/file-uploads/*path", handlers.PreUploadFile)
			projectGroup.DELETE("/agentic-sessions/:sessionName/file-uploads/*path", handlers.DeletePreUploadedFile)
			// Removed: github/push, github/abandon, github/diff - agent handles all git operations
			projectGroup.GET("/agentic-sessions/:sessionName/git/status", handlers.GetGitStatus)
			projectGroup.POST("/agentic-sessions/:sessionName/git/configure-remote", handlers.ConfigureGitRemote)
			// Removed: git/pull, git/push, git/synchronize, git/create-branch, git/list-branches - agent handles all git operations
			projectGroup.GET("/agentic-sessions/:sessionName/git/list-branches", handlers.GitListBranchesSession)
			projectGroup.GET("/agentic-sessions/:sessionName/pod-events", handlers.GetSessionPodEvents)
			projectGroup.POST("/agentic-sessions/:sessionName/workflow", handlers.SelectWorkflow)
			projectGroup.GET("/agentic-sessions/:sessionName/workflow/metadata", handlers.GetWorkflowMetadata)
			projectGroup.POST("/agentic-sessions/:sessionName/repos", handlers.AddRepo)
			// NOTE: /repos/status must come BEFORE /repos/:repoName to avoid wildcard matching
			projectGroup.GET("/agentic-sessions/:sessionName/repos/status", handlers.GetReposStatus)
			projectGroup.DELETE("/agentic-sessions/:sessionName/repos/:repoName", handlers.RemoveRepo)
			projectGroup.PUT("/agentic-sessions/:sessionName/displayname", handlers.UpdateSessionDisplayName)
			projectGroup.POST("/agentic-sessions/:sessionName/model", handlers.SwitchModel)

			// OAuth integration - requires user auth like all other session endpoints
			projectGroup.GET("/agentic-sessions/:sessionName/oauth/:provider/url", handlers.GetOAuthURL)

			// AG-UI Protocol endpoints (middleware pattern)
			// See: https://docs.ag-ui.com/quickstart/introduction
			// POST /agui/run  → starts a run, returns JSON metadata; events broadcast to subscribers
			// GET  /agui/events → SSE stream of all thread events (history + live)
			projectGroup.GET("/agentic-sessions/:sessionName/agui/events", websocket.HandleAGUIEvents)
			projectGroup.POST("/agentic-sessions/:sessionName/agui/run", websocket.HandleAGUIRunProxy)
			projectGroup.POST("/agentic-sessions/:sessionName/agui/interrupt", websocket.HandleAGUIInterrupt)
			projectGroup.POST("/agentic-sessions/:sessionName/agui/feedback", websocket.HandleAGUIFeedback)

			// Background task proxy endpoints
			projectGroup.POST("/agentic-sessions/:sessionName/agui/tasks/:taskId/stop", websocket.HandleTaskStop)
			projectGroup.GET("/agentic-sessions/:sessionName/agui/tasks/:taskId/output", websocket.HandleTaskOutput)
			projectGroup.GET("/agentic-sessions/:sessionName/agui/tasks", websocket.HandleTaskList)

			// Runner capabilities endpoint
			projectGroup.GET("/agentic-sessions/:sessionName/agui/capabilities", websocket.HandleCapabilities)

			// MCP status endpoint
			projectGroup.GET("/agentic-sessions/:sessionName/mcp/status", websocket.HandleMCPStatus)

			// Runtime credential fetch endpoints (for long-running sessions)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/github", handlers.GetGitHubTokenForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/google", handlers.GetGoogleCredentialsForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/jira", handlers.GetJiraCredentialsForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/gitlab", handlers.GetGitLabTokenForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/coderabbit", handlers.GetCodeRabbitCredentialsForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/gerrit", handlers.GetGerritCredentialsForSession)
			projectGroup.GET("/agentic-sessions/:sessionName/credentials/mcp/:serverName", handlers.GetMCPCredentialsForSession)

			// Session export
			projectGroup.GET("/agentic-sessions/:sessionName/export", websocket.HandleExportSession)

			// Scheduled sessions (CronJob-backed)
			projectGroup.GET("/scheduled-sessions", handlers.ListScheduledSessions)
			projectGroup.POST("/scheduled-sessions", handlers.CreateScheduledSession)
			projectGroup.GET("/scheduled-sessions/:scheduledSessionName", handlers.GetScheduledSession)
			projectGroup.PUT("/scheduled-sessions/:scheduledSessionName", handlers.UpdateScheduledSession)
			projectGroup.DELETE("/scheduled-sessions/:scheduledSessionName", handlers.DeleteScheduledSession)
			projectGroup.POST("/scheduled-sessions/:scheduledSessionName/suspend", handlers.SuspendScheduledSession)
			projectGroup.POST("/scheduled-sessions/:scheduledSessionName/resume", handlers.ResumeScheduledSession)
			projectGroup.POST("/scheduled-sessions/:scheduledSessionName/trigger", handlers.TriggerScheduledSession)
			projectGroup.GET("/scheduled-sessions/:scheduledSessionName/runs", handlers.ListScheduledSessionRuns)

			projectGroup.GET("/permissions", handlers.ListProjectPermissions)
			projectGroup.POST("/permissions", handlers.AddProjectPermission)
			projectGroup.DELETE("/permissions/:subjectType/:subjectName", handlers.RemoveProjectPermission)

			projectGroup.GET("/keys", handlers.ListProjectKeys)
			projectGroup.POST("/keys", handlers.CreateProjectKey)
			projectGroup.DELETE("/keys/:keyId", handlers.DeleteProjectKey)

			// Project-level MCP server configuration
			projectGroup.GET("/mcp-servers", handlers.GetProjectMCPServers)
			projectGroup.PUT("/mcp-servers", handlers.UpdateProjectMCPServers)

			projectGroup.GET("/secrets", handlers.ListNamespaceSecrets)
			projectGroup.GET("/runner-secrets", handlers.ListRunnerSecrets)
			projectGroup.PUT("/runner-secrets", handlers.UpdateRunnerSecrets)
			projectGroup.GET("/integration-secrets", handlers.ListIntegrationSecrets)
			projectGroup.PUT("/integration-secrets", handlers.UpdateIntegrationSecrets)

			// Feature flags admin endpoints (workspace-scoped with Unleash fallback)
			projectGroup.GET("/feature-flags", handlers.ListFeatureFlags)
			projectGroup.GET("/feature-flags/evaluate/:flagName", handlers.EvaluateFeatureFlag)
			projectGroup.GET("/feature-flags/:flagName", handlers.GetFeatureFlag)
			projectGroup.PUT("/feature-flags/:flagName/override", handlers.SetFeatureFlagOverride)
			projectGroup.DELETE("/feature-flags/:flagName/override", handlers.DeleteFeatureFlagOverride)
			projectGroup.POST("/feature-flags/:flagName/enable", handlers.EnableFeatureFlag)
			projectGroup.POST("/feature-flags/:flagName/disable", handlers.DisableFeatureFlag)

			// GitLab authentication endpoints (DEPRECATED - moved to cluster-scoped)
			// Kept for backward compatibility, will be removed in future version
			projectGroup.POST("/auth/gitlab/connect", handlers.ConnectGitLabGlobal)
			projectGroup.GET("/auth/gitlab/status", handlers.GetGitLabStatusGlobal)
			projectGroup.POST("/auth/gitlab/disconnect", handlers.DisconnectGitLabGlobal)
		}

		api.POST("/auth/github/install", handlers.LinkGitHubInstallationGlobal)
		api.GET("/auth/github/status", handlers.GetGitHubStatusGlobal)
		api.POST("/auth/github/disconnect", handlers.DisconnectGitHubGlobal)
		api.GET("/auth/github/user/callback", handlers.HandleGitHubUserOAuthCallback)

		// GitHub PAT (alternative to GitHub App)
		api.POST("/auth/github/pat", handlers.SaveGitHubPAT)
		api.GET("/auth/github/pat/status", handlers.GetGitHubPATStatus)
		api.DELETE("/auth/github/pat", handlers.DeleteGitHubPAT)

		// Cluster-level Google OAuth (similar to GitHub App pattern)
		api.POST("/auth/google/connect", handlers.GetGoogleOAuthURLGlobal)
		api.GET("/auth/google/status", handlers.GetGoogleOAuthStatusGlobal)
		api.POST("/auth/google/disconnect", handlers.DisconnectGoogleOAuthGlobal)

		// Unified integrations status endpoint
		api.GET("/auth/integrations/status", handlers.GetIntegrationsStatus)

		// Cluster-level Jira (user-scoped)
		api.POST("/auth/jira/connect", handlers.ConnectJira)
		api.GET("/auth/jira/status", handlers.GetJiraStatus)
		api.DELETE("/auth/jira/disconnect", handlers.DisconnectJira)
		api.POST("/auth/jira/test", handlers.TestJiraConnection)

		// Cluster-level Gerrit (user-scoped, multi-instance)
		api.POST("/auth/gerrit/connect", handlers.ConnectGerrit)
		api.POST("/auth/gerrit/test", handlers.TestGerritConnection)
		api.GET("/auth/gerrit/instances", handlers.ListGerritInstances)
		api.GET("/auth/gerrit/:instanceName/status", handlers.GetGerritStatus)
		api.DELETE("/auth/gerrit/:instanceName/disconnect", handlers.DisconnectGerrit)

		// Cluster-level GitLab (user-scoped)
		api.POST("/auth/gitlab/connect", handlers.ConnectGitLabGlobal)
		api.GET("/auth/gitlab/status", handlers.GetGitLabStatusGlobal)
		api.DELETE("/auth/gitlab/disconnect", handlers.DisconnectGitLabGlobal)
		api.POST("/auth/gitlab/test", handlers.TestGitLabConnection)

		// Cluster-level CodeRabbit (user-scoped)
		api.POST("/auth/coderabbit/connect", handlers.ConnectCodeRabbit)
		api.GET("/auth/coderabbit/status", handlers.GetCodeRabbitStatus)
		api.DELETE("/auth/coderabbit/disconnect", handlers.DisconnectCodeRabbit)
		api.POST("/auth/coderabbit/test", handlers.TestCodeRabbitConnection)

		// Generic MCP server credentials (user-scoped)
		api.POST("/auth/mcp/:serverName/connect", handlers.ConnectMCPServer)
		api.GET("/auth/mcp/:serverName/status", handlers.GetMCPServerStatus)
		api.DELETE("/auth/mcp/:serverName/disconnect", handlers.DisconnectMCPServer)

		// Cluster info endpoint (public, no auth required)
		api.GET("/cluster-info", handlers.GetClusterInfo)

		// Version endpoint (public, no auth required)
		api.GET("/version", handlers.GetVersion)

		// LDAP search endpoints (cluster-scoped, auth-required)
		api.GET("/ldap/users", handlers.SearchLDAPUsers)
		api.GET("/ldap/users/:uid", handlers.GetLDAPUser)
		api.GET("/ldap/groups", handlers.SearchLDAPGroups)

		api.GET("/projects", handlers.ListProjects)
		api.POST("/projects", handlers.CreateProject)
		api.GET("/projects/:projectName", handlers.GetProject)
		api.PUT("/projects/:projectName", handlers.UpdateProject)
		api.DELETE("/projects/:projectName", handlers.DeleteProject)
	}

	// Health check endpoint
	r.GET("/health", handlers.Health)

	// Generic OAuth2 callback endpoint (outside /api for MCP compatibility)
	r.GET("/oauth2callback", handlers.HandleOAuth2Callback)

	// OAuth callback status endpoint (for checking OAuth flow status)
	r.GET("/oauth2callback/status", handlers.GetOAuthCallbackEndpoint)
}