"""URL patterns for the ``/mcp_server/api/`` DRF control-plane API.

These endpoints are called by the Daedalus backend authenticated as
the owning Mnemosyne user (per-user ``UserToken``,
``Authorization: Bearer …``, minted at ``/profile/tokens/``). Every team is scoped
to its ``owner`` — cross-user access returns 404. End-user MCP traffic
does NOT go through this surface — that's ``mnemosyne.asgi`` /
``mcp_server/server.py``.
"""

from __future__ import annotations

from django.urls import path

from . import teams

app_name = "mcp-server-api"

urlpatterns = [
    # Teams (Daedalus-Pallas integration; see
    # docs/DAEDALUS_PALLAS_INTEGRATION_v1.md §7).
    path("teams/", teams.team_create, name="team-create"),
    path(
        "teams/<uuid:team_id>/",
        teams.team_detail,
        name="team-detail",
    ),
    path(
        "teams/<uuid:team_id>/workspaces/",
        teams.team_workspaces,
        name="team-workspaces",
    ),
    path(
        "teams/<uuid:team_id>/rotate/",
        teams.team_rotate,
        name="team-rotate",
    ),
]
