using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace MailSharp.MailClient.Controllers;

// Serves only the page shell - all data (login defaults, translations, the actual
// authentication call) is fetched client-side from Controllers/Api via login.js.
// Must stay reachable while logged out (this IS the login page), and since MapControllers()
// and MapControllerRoute() share the same endpoint data source, RequireAuthorization() on the
// API routes would otherwise leak onto this conventionally-routed controller too.
[AllowAnonymous]
public class AccountController : Controller
{
	[HttpGet]
	public IActionResult Login() => View();

	// Cookie auth's default AccessDeniedPath ("/Account/AccessDenied") needs a real action to land
	// on - without one this 404s instead of explaining anything. Most common cause: the account was
	// just promoted to admin (see Program.cs auto-promote, or the claim-admin bootstrap endpoint)
	// but the current session's cookie predates that and still lacks the admin claim - re-issued
	// only on next login/account-switch (see SessionAccountManager.SignInAsync).
	[HttpGet]
	public IActionResult AccessDenied() => View();
}