import { t } from "@repo/core-shared/trpc/init";
import { defineErrorMiddleware } from "@repo/core-shared/trpc/define-error-middleware";
import { requireAuthenticated } from "@repo/core-shared/trpc/require-authenticated";

import { ArticleNotFoundError } from "../../entities/errors/article";
import { InputParseError } from "../../entities/errors/common";

export const blogProcedure = t.procedure.use(
  defineErrorMiddleware([
    [InputParseError, "BAD_REQUEST"],
    [ArticleNotFoundError, "NOT_FOUND"],
  ]),
);

/**
 * Base procedure for MUTATING blog routes (audit finding B7): anonymous
 * callers are rejected with UNAUTHORIZED before the controller runs.
 * Read-only queries stay on `blogProcedure`.
 */
export const blogProtectedProcedure = blogProcedure.use(requireAuthenticated);