router.ex

defmodule ElijahWeb.Router do
  use ElijahWeb, :router
  import ElijahWeb.UserAuth
  import Plug.BasicAuth

  alias ElijahWeb.EnsureRolePlug

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_live_flash
    plug :put_root_layout, {ElijahWeb.LayoutView, :root}
    plug :protect_from_forgery
    plug :put_secure_browser_headers
    plug ElijahWeb.GenerateCSRF
    plug ElijahWeb.AssignSession
    plug :fetch_current_user
  end

  pipeline :api do
    plug :accepts, ["json"]
  end

  pipeline :user do
    plug EnsureRolePlug, [:admin, :user]
  end

  pipeline :admin do
    plug EnsureRolePlug, :admin
  end

  pipeline :api_authenticated do
    plug ElijahWeb.AuthAccessPipeline
  end

  pipeline :graphql do
    plug ElijahWeb.Context
  end

  scope "/rest", ElijahWeb.Api, as: :api do
    pipe_through :api

    post "/sign_in", SessionController, :create
    scope "/search" do
      post "/", SearchController, :searchv13
    end
  end

  scope "/api" do
    pipe_through :graphql

    forward "/", Absinthe.Plug, schema: ElijahWeb.Schema
  end

  scope "/", ElijahWeb do
    pipe_through :browser

    live "/", PageLive, :index
  end

  # Enables LiveDashboard only for development
  #
  # If you want to use the LiveDashboard in production, you should put
  # it behind authentication and allow only admins to access it.
  # If your application does not have an admins-only section yet,
  # you can use Plug.BasicAuth to set up some basic authentication
  # as long as you are also using SSL (which you should anyway).
  if Mix.env() in [:dev, :test] do
    import Phoenix.LiveDashboard.Router

    scope "/" do
      pipe_through :browser
      live_dashboard "/dashboard", metrics: ElijahWeb.Telemetry
    end
  end

  ## Authentication routes

  scope "/", ElijahWeb do
    pipe_through [:browser, :redirect_if_user_is_authenticated, :put_session_layout]

    get "/users/register", UserRegistrationController, :new
    post "/users/register", UserRegistrationController, :create
    get "/users/redeem_invite/:token", UserRegistrationController, :redeem_invite

    # show email entry login
    get "/users/login", UserSessionController, :new
    # user just POSTed email address, get matching User and send OTP/six-digit email
    post "/users/login", UserSessionController, :create_otp
    # post to this endpoint to receive otp token and show otp/six-digit form
    # could not generate valid csrf_token -- DEPRECATED
    post("/users/confirm_otp", UserSessionController, :confirm_otp)
    # GET to this endpoint to receive otp token and show otp/six-digit form
    get("/users/confirm_otp/:nonce", UserSessionController, :confirm_otp)
    # POST to verify_otp to complete login verification process
    post("/users/verify_otp", UserSessionController, :verify_otp)
  end

  scope "/", ElijahWeb do
    pipe_through [:browser, :require_authenticated_user, :user]

    get "/users/settings", UserSettingsController, :edit
    put "/users/settings/update_password", UserSettingsController, :update_password
    put "/users/settings/update_email", UserSettingsController, :update_email
    get "/users/settings/confirm_email/:token", UserSettingsController, :confirm_email
    put "/users/settings/update_avatar", UserSettingsController, :update_avatar
    put "/users/settings/update_phone_number", UserSettingsController, :update_phone_number
    put "/users/settings/update_username", UserSettingsController, :update_username
    put "/users/settings/update_name", UserSettingsController, :update_name
  end


  scope "/", ElijahWeb do
    pipe_through [:browser, :require_authenticated_user, :admin]

    # https://elixirforum.com/t/myappweb-router-helpers-live-path-2-is-undefined-or-private/29263/4?u=maz
    live "/invitations", InvitationRequestLive.Index
    resources "/invitations", InvitationRequestController
    resources "/upload/invitationrequests", UploadInvitationRequestsController, only: [:index, :create]
  end

  scope "/", ElijahWeb do
    pipe_through [:browser]

    delete "/users/logout", UserSessionController, :delete
    get "/users/confirm", UserConfirmationController, :new
    post "/users/confirm", UserConfirmationController, :create
    get "/users/confirm/:token", UserConfirmationController, :confirm
  end

  if Mix.env() == :dev do
    forward "/sent_emails", Bamboo.SentEmailViewerPlug
  end

  if Mix.env() == :dev do
    forward "/graphiql", Absinthe.Plug.GraphiQL, schema: ElijahWeb.Schema
  end
end