// server/utils/api-auth-rules.ts - API 鉴权路由规则表：声明公开路由，其余默认需要登录

type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";

type ApiRouteRule = {
  path: string | RegExp;
  method?: HttpMethod | HttpMethod[];
};

/**
 * 公开 API 路由规则表
 *
 * 新增接口默认需要登录，无需任何改动；
 * 只有明确需要公开访问的路由才加到这里。
 */
export const publicApiRoutes: ApiRouteRule[] = [
  // Better Auth 自己的登录、注册、退出、get-session 等接口必须放行
  { path: "/api/auth/**" },
  // 服务健康检查，供部署平台和 Docker healthcheck 使用，不含敏感信息
  { method: "GET", path: "/api/health" },
  // OCS 油猴脚本跨域无法携带 cookie，搜索接口有自己的双通道鉴权（session 或 apiToken）
  { path: "/api/search" }
];

/** 路径匹配：支持精确匹配、`/**` 前缀通配和 RegExp */
const matchPath = (rulePath: string | RegExp, pathname: string): boolean => {
  if (rulePath instanceof RegExp) return rulePath.test(pathname);
  if (rulePath.endsWith("/**")) {
    const prefix = rulePath.slice(0, -3);
    return pathname === prefix || pathname.startsWith(`${prefix}/`);
  }
  return pathname === rulePath;
};

/** 判断当前请求是否命中公开路由规则 */
export const isPublicApiRoute = (pathname: string, method: string): boolean =>
  publicApiRoutes.some((rule) => {
    const methods = Array.isArray(rule.method)
      ? rule.method
      : rule.method
        ? [rule.method]
        : null;
    const methodMatched = !methods || methods.includes(method as HttpMethod);
    return methodMatched && matchPath(rule.path, pathname);
  });