// The setup controller itself further requires a valid boot token to actually
// render the form — see Setup.php.
$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
if (!\CustomSSO\Controllers\Setup::alreadySetUp()
    && !str_starts_with($path, '/setup')
    && !str_starts_with($path, '/assets/')) {
    header('Location: /setup', true, 302);
    exit;
}

$r = new Router();

$r->get ('/login',                            [\CustomSSO\Controllers\Auth::class,      'showLogin']);
$r->post('/login',                            [\CustomSSO\Controllers\Auth::class,      'doLogin']);
$r->post('/logout',                           [\CustomSSO\Controllers\Auth::class,      'doLogout']);
$r->get ('/forgot-password',                  [\CustomSSO\Controllers\PasswordRecovery::class, 'showForm']);
$r->post('/forgot-password',                  [\CustomSSO\Controllers\PasswordRecovery::class, 'submit']);

// First-run boot-token setup — reachable when users table is empty
$r->get ('/setup',                            [\CustomSSO\Controllers\Setup::class,     'show']);
$r->post('/setup',                            [\CustomSSO\Controllers\Setup::class,     'submit']);