import { Router } from 'express';
import * as organizationController from '../controllers/organization.controller.js';
import validate from '../middlewares/validate.js';
import verifyFirebaseToken from '../middlewares/verifyFirebaseToken.js';
import authorize from '../middlewares/authorize.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import { decodeId } from '../utils/idCodec.js';
import { errorResponse } from '../utils/response.js';
import {
  createOrganizationSchema, updateOrganizationSchema, updateStatusSchema, updateSubscriptionSchema, changeTenantAdminSchema,
} from '../validators/organization.validator.js';

const router = Router();

// Unlike the operational masters (units, materials, ...), organizations is
// the multi-tenancy anchor — admin-only end to end, same as roles/permissions.
router.use(verifyFirebaseToken, authorize('admin'));

router.param('id', (req, res, next, value: string) => {
  const decoded = decodeId(value);
  if (decoded === null) return void errorResponse(res, 'Invalid id', 400);
  req.params.id = String(decoded);
  next();
});

router.get('/', organizationController.getOrganizations);
router.post('/', validate(createOrganizationSchema), organizationController.createOrganization);
router.all('/', methodNotAllowed('GET', 'POST'));

router.get('/:id', organizationController.getOrganization);
router.patch('/:id', validate(updateOrganizationSchema), organizationController.updateOrganization);
router.all('/:id', methodNotAllowed('GET', 'PATCH'));

router.get('/:id/users', organizationController.getOrganizationUsers);
router.all('/:id/users', methodNotAllowed('GET'));

router.patch('/:id/status', validate(updateStatusSchema), organizationController.updateStatus);
router.all('/:id/status', methodNotAllowed('PATCH'));

router.patch('/:id/subscription', validate(updateSubscriptionSchema), organizationController.updateSubscription);
router.all('/:id/subscription', methodNotAllowed('PATCH'));

router.put('/:id/tenant-admin', validate(changeTenantAdminSchema), organizationController.changeTenantAdmin);
router.all('/:id/tenant-admin', methodNotAllowed('PUT'));

router.post('/:id/tenant-admin/invite', organizationController.resendTenantAdminInvite);
router.all('/:id/tenant-admin/invite', methodNotAllowed('POST'));

export default router;