/**
 * contact-submission router
 *
 * `create` is the one action the Public role holds here, so the POST route
 * carries two middlewares and the ORDER matters:
 *
 *   1. `global::rate-limit`      caps how often one IP may post, before any
 *                                work is done on the body.
 *   2. `api::contact-submission.sanitize-submission`
 *                                drops every field that is not on the client
 *                                whitelist and sets the server-owned state.
 *
 * See `src/middlewares/rate-limit.ts` for the limiter's scope and its
 * single-instance caveat.
 */

import { factories } from '@strapi/strapi';

export default factories.createCoreRouter('api::contact-submission.contact-submission', {
  config: {
    create: {
      middlewares: [
        {
          name: 'global::rate-limit',
          config: { name: 'contact-submission-create', interval: 60_000, max: 5 },
        },
        'api::contact-submission.sanitize-submission',
      ],
    },
  },
});