import {
  Body,
  Controller,
  Get,
  Param,
  Patch,
  Post,
  Query,
} from '@nestjs/common';
import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
import { CurrentUser } from '../auth/decorators/current-user.decorator';
import { RequirePermission } from '../auth/decorators/require-permission.decorator';
import type { AuthenticatedUser } from '../auth/types/authenticated-user';
import { PermissionResolverService } from '../auth/permissions/permission-resolver.service';
import { Idempotent } from '../common/idempotency/idempotent.decorator';
import { ApiaryRestrictionsService } from './apiary-restrictions.service';
import { CreateApiaryRestrictionDto } from './dto/create-apiary-restriction.dto';
import { RestrictionListQuery } from './dto/restriction-list-query.dto';
import { UpdateApiaryRestrictionDto } from './dto/update-apiary-restriction.dto';

// Full paths on an empty prefix: the list lives under /apiary-restrictions,
// the per-apiary read under /apiaries/:id/restrictions.
@ApiTags('apiary-restrictions')
@ApiBearerAuth()
@Controller()
export class ApiaryRestrictionsController {
  constructor(
    private readonly restrictions: ApiaryRestrictionsService,
    private readonly permissions: PermissionResolverService,
  ) {}

  // Authority, file reference and notes are for compliance:read only.
  private async mayReadDetails(actor: AuthenticatedUser): Promise<boolean> {
    return (await this.permissions.getPermissions(actor.id)).has(
      'compliance:read',
    );
  }

  @RequirePermission('apiaries:read')
  @Get('apiary-restrictions')
  async findAll(
    @Query() query: RestrictionListQuery,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.restrictions.list(
      query.active,
      await this.mayReadDetails(actor),
    );
  }

  @RequirePermission('apiaries:read')
  @Get('apiaries/:id/restrictions')
  async findForApiary(
    @Param('id') id: string,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.restrictions.findForApiary(
      id,
      await this.mayReadDetails(actor),
    );
  }

  @RequirePermission('compliance:manage')
  @Idempotent()
  @Post('apiary-restrictions')
  create(
    @Body() dto: CreateApiaryRestrictionDto,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.restrictions.create(dto, actor.id);
  }

  @RequirePermission('compliance:manage')
  @Patch('apiary-restrictions/:id')
  update(
    @Param('id') id: string,
    @Body() dto: UpdateApiaryRestrictionDto,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.restrictions.update(id, dto, actor.id);
  }
}