import {
  Body,
  Controller,
  Delete,
  Get,
  Param,
  Post,
  Put,
  Req,
} from '@nestjs/common';
import type { AuthenticatedRequest } from '../auth/authenticated-request';
import { RequirePermissions } from '../auth/guards/require-permissions.decorator';
import { ApiError } from '../common/errors/api-error';
import { ErrorCode } from '../common/errors/error-codes';
import { SensitiveRateLimit } from '../common/rate-limit/sensitive-rate-limit.decorator';
import { Permission } from './permissions';
import { CreateRoleDto, UpdateRoleDto } from './dto/role.dto';
import { RolesService } from './roles.service';

@Controller('admin/roles')
export class AdminRolesController {
  constructor(private readonly roles: RolesService) {}

  @Get()
  @RequirePermissions(Permission.RolesRead)
  list() {
    return this.roles.adminList();
  }

  @Get(':id')
  @RequirePermissions(Permission.RolesRead)
  get(@Param('id') id: string) {
    return this.roles.adminGet(id);
  }

  @Post()
  @RequirePermissions(Permission.RolesManage)
  @SensitiveRateLimit()
  create(@Req() req: AuthenticatedRequest, @Body() dto: CreateRoleDto) {
    return this.roles.create(dto, this.requireUser(req));
  }

  @Put(':id')
  @RequirePermissions(Permission.RolesManage)
  @SensitiveRateLimit()
  update(
    @Req() req: AuthenticatedRequest,
    @Param('id') id: string,
    @Body() dto: UpdateRoleDto,
  ) {
    return this.roles.update(id, dto, this.requireUser(req));
  }

  @Delete(':id')
  @RequirePermissions(Permission.RolesManage)
  @SensitiveRateLimit()
  delete(@Req() req: AuthenticatedRequest, @Param('id') id: string) {
    return this.roles.delete(id, this.requireUser(req));
  }

  private requireUser(req: AuthenticatedRequest) {
    if (!req.user) {
      throw new ApiError(
        ErrorCode.Unauthorized,
        'Bitte melden Sie sich an.',
        401,
      );
    }
    return req.user;
  }
}