// Root data-source redirect only.

const { PERMISSION_DENIED_MESSAGE } = require('#src/rbac');

module.exports = function registerDataSourceRoutes(app, deps) {
  const setAuthMessageCookie = deps.setAuthMessageCookie;
  const { hasAnyPermission } = require('#src/rbac');

  app.get('/data-sources', function (req, res, next) {
    if (!req.currentUser) {
      if (typeof setAuthMessageCookie === 'function') {
        setAuthMessageCookie(res, 'Please sign in to continue.');
        return res.redirect('/login');
      }
      return res.redirect('/login');
    }

    if (hasAnyPermission(req.currentUser, ['timetables.read', 'rss-feeds.read', 'api-sources.read'])) {
      if (hasAnyPermission(req.currentUser, ['timetables.read'])) {
        return res.redirect('/data-sources/timetables');
      }
      if (hasAnyPermission(req.currentUser, ['rss-feeds.read'])) {
        return res.redirect('/data-sources/rss-feeds');
      }
      return res.redirect('/data-sources/api-sources');
    }

    const error = new Error(PERMISSION_DENIED_MESSAGE);
    error.statusCode = 403;
    error.expose = true;
    next(error);
  });
};