# Cinderpath customer site CWL genome (tip 1.0.28 semantics)
# Language pillar: AgenticOp-io/chrysalis-cwl
# cinderpath-web compiles this file to embedded JSON and renders GET pages from it.
# Go is the hole executor: bcrypt, sqlite sessions, POP /v1/sessions, QR PNG, load bindings.

module cinderpath;
use json;
use urlencoded;
use auth session;

import "site-static.cwl";
import "site-interactive.cwl";

layout site {
  header User-Agent;
  hole unsupported:opaque-script;
  client ui "device" {
    on resize { action "classify-device"; }
  }
  chrome html "<header class='top'><a class='brand' href='/'><img src='/static/mark.png' width='40' height='40' alt=''> Cinderpath</a><nav><a href='/shop'>Paths</a><a href='/path'>The path</a><a href='/security'>Security</a><a href='/downloads'>Apps</a><a class='cwl-chip' href='/cwl' title='Chrysalis Web Language'>CWL</a>nav_auth</nav></header>";
}

@route GET "/healthz"
handler healthz {
  effects: none;
  return { ok: true, service: "cinderpath-web", genome: "cwl", tip: "1.0.28" };
}

@route GET "/cwl-security"
handler cwl_security {
  effects: none;
  header User-Agent;
  return { ok: true, product: "cwl-security", built_in: true, scope: "cinderpath-control-plane", genome: "/cinderpath.cwl", tip: "1.0.28", tunnel_inspection: false };
}

@route POST "/login"
handler login_post {
  effects: session.write, csrf.verify, db.read;
  body email;
  body password;
  body next;
  response-header Set-Cookie = "cp_session=; Path=/; HttpOnly; SameSite=Lax";
  return { ok: true };
}

@route POST "/register"
handler register_post {
  effects: session.write, db.write;
  body email;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/logout"
handler logout {
  effects: session.write;
  return { ok: true };
}

@route POST "/forgot"
handler forgot_post {
  effects: db.read, mail.send;
  body email;
  return { ok: true };
}

@route POST "/reset"
handler reset_post {
  effects: db.write;
  body token;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/account/password"
handler account_password {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body current;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/shop/buy"
handler shop_buy {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body sku;
  return { ok: true, sku: sku };
}

@route POST "/connect"
handler connect_post {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body sku;
  body exit;
  body client;
  hole hub-cwl:upstream-proxy;
}

@route GET "/connect/conf"
handler connect_conf {
  effects: session.read, auth.require;
  hole hub-cwl:upstream-proxy;
}

@route GET "/connect/qr.png"
handler connect_qr {
  effects: session.read, auth.require;
  hole hub-cwl:upstream-proxy;
}

@route POST "/admin/grant"
handler admin_grant {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body email;
  body sku;
  return { ok: true };
}

@route POST "/admin/password"
handler admin_password {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body email;
  body password;
  return { ok: true };
}