import express, {Request, Response} from 'express';
import {requireAppAccess, requireSignedIn} from './admin.middleware.js';
import {usersAdminRouter} from './users/users.admin.router.js';
import {invitationsRouter} from './invitations/invitations.router.js';

/**
 * The admin module's JSON routes. Deliberately *not* the better-auth handler:
 * that one is mounted separately in app.ts, ahead of express.json(), because it
 * needs the raw request body stream.
 *
 * Mounted at /admin, so the tree is:
 *   /admin/me            any signed-in account
 *   /admin/users/*       admin permission
 *   /admin/invitations/* admin permission
 */
export const adminRouter = express.Router();

/**
 * @swagger
 * /admin/me:
 *      get:
 *          summary: The current user's identity and app permissions
 *          description: Used by every frontend to decide what to show. The API remains the real gate.
 *          tags: [admin]
 *          responses:
 *              200:
 *                  description: Success
 *              401:
 *                  description: Not signed in
 *              403:
 *                  description: Account disabled
 */
adminRouter.get('/me', requireSignedIn, (req: Request, res: Response) => {
	res.status(200).send({
		id: res.locals.admin.id,
		email: res.locals.admin.email,
		fullName: res.locals.admin.displayName,
		// `permissions` is the full (app, role) truth; `apps` is the distinct
		// apps within it. Both are sent because the three frontends only ever ask
		// "may I show this app?", and keeping `apps` means a finer permission can
		// land here without a coordinated deploy of all of them.
		permissions: res.locals.admin.permissions,
		apps: res.locals.admin.apps
	});
});

adminRouter.use('/users', requireAppAccess('admin'), usersAdminRouter);
adminRouter.use('/invitations', requireAppAccess('admin'), invitationsRouter);