import { Router } from 'express';
import { body, param } from 'express-validator';
import { adminController } from './admin.controller';
import { authenticate, authorize } from '../../shared/middleware/auth';
import { validate } from '../../shared/middleware/validation';

const router = Router();
router.use(authenticate);

// ========== USERS ==========

router.get(
  '/users',
  authorize('admin', 'users', 'read'),
  adminController.findAllUsers
);

router.get(
  '/users/:id',
  authorize('admin', 'users', 'read'),
  param('id').isUUID(),
  validate,
  adminController.findUserById
);

router.post(
  '/users',
  authorize('admin', 'users', 'create'),
  [
    body('email').isEmail(),
    body('username').notEmpty().trim(),
    body('password').isLength({ min: 8 }),
    body('employeeId').isUUID(),
  ],
  validate,
  adminController.createUser
);

router.put(
  '/users/:id',
  authorize('admin', 'users', 'update'),
  [
    param('id').isUUID(),
    body('email').optional().isEmail(),
    body('username').optional().notEmpty().trim(),
    body('password').optional().isLength({ min: 8 }),
  ],
  validate,
  adminController.updateUser
);

router.patch(
  '/users/:id/toggle-active',
  authorize('admin', 'users', 'update'),
  param('id').isUUID(),
  validate,
  adminController.toggleUserActive
);

router.delete(
  '/users/:id',
  authorize('admin', 'users', 'delete'),
  param('id').isUUID(),
  validate,
  adminController.deleteUser
);

// ========== AUDIT LOGS ==========

router.get(
  '/audit-logs',
  authorize('admin', 'audit-logs', 'read'),
  adminController.getAuditLogs
);

// ========== STATS ==========

router.get(
  '/stats',
  authorize('admin', 'stats', 'read'),
  adminController.getStats
);

// ========== POSITIONS (ROLES) ==========

router.get(
  '/positions',
  authorize('admin', 'roles', 'read'),
  adminController.getPositions
);

router.post(
  '/positions',
  authorize('admin', 'roles', 'create'),
  [
    body('title').notEmpty().trim(),
    body('code').notEmpty().trim(),
    body('departmentId').isUUID(),
    body('level').optional().isInt({ min: 1 }),
  ],
  validate,
  adminController.createPosition
);

router.put(
  '/positions/:id',
  authorize('admin', 'roles', 'update'),
  [
    param('id').isUUID(),
    body('title').optional().notEmpty().trim(),
    body('code').optional().notEmpty().trim(),
    body('departmentId').optional().isUUID(),
    body('level').optional().isInt({ min: 1 }),
  ],
  validate,
  adminController.updatePosition
);

router.put(
  '/positions/:id/permissions',
  authorize('admin', 'roles', 'update'),
  [
    param('id').isUUID(),
    body('permissions').isArray(),
  ],
  validate,
  adminController.updatePositionPermissions
);

// ========== PERMISSION GROUPS (Phase 3 - multi-group) ==========

router.get(
  '/permission-groups',
  authorize('admin', 'roles', 'read'),
  adminController.getPermissionGroups
);

router.post(
  '/permission-groups',
  authorize('admin', 'roles', 'create'),
  [
    body('name').notEmpty().trim(),
  ],
  validate,
  adminController.createPermissionGroup
);

router.put(
  '/permission-groups/:id',
  authorize('admin', 'roles', 'update'),
  [param('id').isUUID()],
  validate,
  adminController.updatePermissionGroup
);

router.put(
  '/permission-groups/:id/permissions',
  authorize('admin', 'roles', 'update'),
  [
    param('id').isUUID(),
    body('permissions').isArray(),
  ],
  validate,
  adminController.updatePermissionGroupPermissions
);

router.get(
  '/users/:userId/roles',
  authorize('admin', 'users', 'read'),
  [param('userId').isUUID()],
  validate,
  adminController.getUserRoles
);

router.post(
  '/users/:userId/roles',
  authorize('admin', 'users', 'update'),
  [
    param('userId').isUUID(),
    body('roleId').isUUID(),
  ],
  validate,
  adminController.assignUserRole
);

router.delete(
  '/users/:userId/roles/:roleId',
  authorize('admin', 'users', 'update'),
  [param('userId').isUUID(), param('roleId').isUUID()],
  validate,
  adminController.removeUserRole
);

export default router;
