import type { FastifyInstance } from 'fastify';
import { authenticate, requireRole } from '../middleware/auth.js';
import { authService } from '../services/authService.js';
import { auditService } from '../services/auditService.js';

const adminGuard = [authenticate, requireRole('admin')];

export async function userRoutes(fastify: FastifyInstance) {
  // GET /api/v1/users
  fastify.get('/', { preHandler: adminGuard }, async (_req, reply) => {
    return reply.send(await authService.listUsers());
  });

  // POST /api/v1/users
  fastify.post('/', { preHandler: adminGuard }, async (req, reply) => {
    const { email, password, role } = req.body as { email: string; password: string; role: 'admin' | 'user' };
    if (!email || !password || !role) {
      return reply.status(400).send({ error: 'email, password and role are required' });
    }
    try {
      const user = await authService.createUser(email, password, role);
      await auditService.log(req.user!.sub, 'user', 'user.created', 'user', user.id, { email, role });
      return reply.status(201).send(user);
    } catch (err: unknown) {
      const e = err as { message: string };
      return reply.status(409).send({ error: e.message });
    }
  });

  // PATCH /api/v1/users/:id
  fastify.patch('/:id', { preHandler: adminGuard }, async (req, reply) => {
    const { id } = req.params as { id: string };
    const patch = req.body as { role?: 'admin' | 'user'; is_active?: boolean };
    const user = await authService.updateUser(id, patch);
    if (patch.role !== undefined) {
      await auditService.log(req.user!.sub, 'user', 'user.role_changed', 'user', id, { role: patch.role });
    }
    return reply.send(user);
  });

  // DELETE /api/v1/users/:id  (deactivate)
  fastify.delete('/:id', { preHandler: adminGuard }, async (req, reply) => {
    const { id } = req.params as { id: string };
    await authService.deactivateUser(id);
    await auditService.log(req.user!.sub, 'user', 'user.deactivated', 'user', id, {});
    return reply.status(204).send();
  });
}