// The entire module is now a function that accepts 'contactController' as an argument.
module.exports = (contactController) => {
    const express = require('express');
    const router = express.Router();
    const rateLimit = require('express-rate-limit');
    const { body, validationResult } = require('express-validator');
    // Remove the old require statement since we are getting the controller as an argument
    // const contactController = require('../controllers/contactController');
    const { formSecurityCheck } = require('../middleware/securityMw');

    // 🛡️ Configure rate limiting to prevent DDoS and spamming
    const apiLimiter = rateLimit({
        windowMs: 15 * 60 * 1000, // 15 minutes
        max: 5,
        message: "Too many requests from this IP, please try again after 15 minutes."
    });

    // Define the route for form submissions
    router.post('/submit-form',
        apiLimiter,
        [
            // express-validator: sanitation and validation
            body('firstName').trim().escape(),
            body('lastName').trim().escape(),
            body('email').isEmail().normalizeEmail(),
            body('organization').trim().escape(),
            body('phone').trim(),
            body('message').trim().escape(),
        ],
        // Middleware to handle the express-validator results
        (req, res, next) => {
            const errors = validationResult(req);
            if (!errors.isEmpty()) {
                console.error('Validation failed:', errors.array());
                return res.status(400).json({ success: false, message: 'Invalid form data.' });
            }
            next();
        },
        // The security middleware
        formSecurityCheck,
        // The controller, which is the final step
        contactController.submitForm
    );

    // Return the configured router
    return router;
};