import { Router } from 'express';
import { getUsers, updateUserRole, updateUserOrganization } from '../controllers/user.controller.js';
import validate from '../middlewares/validate.js';
import verifyFirebaseToken from '../middlewares/verifyFirebaseToken.js';
import authorize from '../middlewares/authorize.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import { decodeId } from '../utils/idCodec.js';
import { errorResponse } from '../utils/response.js';
import { updateUserRoleSchema, updateUserOrganizationSchema } from '../validators/user.validator.js';

const router = Router();

// User records hold app data tied to a real Firebase identity, so every
// route here is admin-only rather than the open demo endpoint this used to be.
router.use(verifyFirebaseToken, authorize('admin'));

// Every :id on this router arrives base64url-encoded (see src/utils/idCodec.ts).
router.param('id', (req, res, next, value: string) => {
  const decoded = decodeId(value);
  if (decoded === null) return void errorResponse(res, 'Invalid id', 400);
  req.params.id = String(decoded);
  next();
});

router.get('/', getUsers);
router.all('/', methodNotAllowed('GET'));

router.patch('/:id/role', validate(updateUserRoleSchema), updateUserRole);
router.all('/:id/role', methodNotAllowed('PATCH'));

router.patch('/:id/organization', validate(updateUserOrganizationSchema), updateUserOrganization);
router.all('/:id/organization', methodNotAllowed('PATCH'));

export default router;