import { Router } from 'express';
import * as planController from '../controllers/plan.controller.js';
import validate from '../middlewares/validate.js';
import verifyFirebaseToken from '../middlewares/verifyFirebaseToken.js';
import authorize from '../middlewares/authorize.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import { createPlanSchema, updatePlanSchema } from '../validators/plan.validator.js';

const router = Router();

// SaaS Admin only (the platform owner picks plans when onboarding a tenant) —
// admin-only end to end, same as organizations/roles/permissions. Plan ids
// are opaque cuids already, so unlike most `:id` routes in this app they
// are not base64url-encoded.
router.use(verifyFirebaseToken, authorize('admin'));

router.get('/', planController.getPlans);
router.post('/', validate(createPlanSchema), planController.createPlan);
router.all('/', methodNotAllowed('GET', 'POST'));

router.get('/:id', planController.getPlan);
router.patch('/:id', validate(updatePlanSchema), planController.updatePlan);
router.all('/:id', methodNotAllowed('GET', 'PATCH'));

export default router;