import { Router } from 'express';
import * as roleController from '../controllers/role.controller.js';
import validate from '../middlewares/validate.js';
import verifyFirebaseToken from '../middlewares/verifyFirebaseToken.js';
import authorize from '../middlewares/authorize.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import { decodeId } from '../utils/idCodec.js';
import { errorResponse } from '../utils/response.js';
import { createRoleSchema, updateRoleSchema, assignPermissionsSchema } from '../validators/role.validator.js';

const router = Router();

router.use(verifyFirebaseToken, authorize('admin'));

// Every :id on this router arrives base64url-encoded (see src/utils/idCodec.ts);
// decode it once here instead of repeating that in every handler.
router.param('id', (req, res, next, value: string) => {
  const decoded = decodeId(value);
  if (decoded === null) return void errorResponse(res, 'Invalid id', 400);
  req.params.id = String(decoded);
  next();
});

router.get('/', roleController.getRoles);
router.post('/', validate(createRoleSchema), roleController.createRole);
router.all('/', methodNotAllowed('GET', 'POST'));

router.get('/:id', roleController.getRole);
router.patch('/:id', validate(updateRoleSchema), roleController.updateRole);
router.delete('/:id', roleController.deleteRole);
router.all('/:id', methodNotAllowed('GET', 'PATCH', 'DELETE'));

router.put('/:id/permissions', validate(assignPermissionsSchema), roleController.setRolePermissions);
router.all('/:id/permissions', methodNotAllowed('PUT'));

export default router;