import { Controller, Get, Req } from "@nestjs/common";
import type { Request } from "express";
import { IamService } from "./iam.service.js";
import type { ViewportItem } from "./iam.service.js";
import type { Role, Permission } from "./iam.schema.js";
import { UnauthorizedError } from "../shared/errors/application-error.js";
import {
  Permissions,
  RequirePermission,
} from "../middleware/permission.guard.js";

// RBAC 管理端点：角色/权限/视口查询
@Controller("iam")
export class RbacController {
  constructor(private readonly service: IamService) {}

  // 获取当前用户的视口配置（L1 导航）
  @Get("viewports")
  @RequirePermission(Permissions.IAM_USER_READ)
  async viewports(
    @Req() req: Request,
  ): Promise<{ success: true; data: ViewportItem[] }> {
    const userIdHeader = req.headers["x-user-id"];
    const userId = typeof userIdHeader === "string" ? userIdHeader : undefined;
    if (!userId) {
      throw new UnauthorizedError("Missing x-user-id header");
    }
    const data = await this.service.getUserViewports(userId);
    return { success: true as const, data };
  }

  // 获取当前用户的有效权限
  @Get("permissions/effective")
  @RequirePermission(Permissions.IAM_USER_READ)
  async effectivePermissions(
    @Req() req: Request,
  ): Promise<{ success: true; data: { permissions: string[] } }> {
    const userIdHeader = req.headers["x-user-id"];
    const userId = typeof userIdHeader === "string" ? userIdHeader : undefined;
    if (!userId) {
      throw new UnauthorizedError("Missing x-user-id header");
    }
    const permissions = await this.service.getEffectivePermissions(userId);
    return { success: true as const, data: { permissions } };
  }

  // 列出所有角色（管理端用）
  @Get("roles")
  @RequirePermission(Permissions.IAM_ROLE_MANAGE)
  async roles(): Promise<{ success: true; data: Role[] }> {
    const data = await this.service.getAllRoles();
    return { success: true as const, data };
  }

  // 列出所有权限点（管理端用）
  @Get("permissions")
  @RequirePermission(Permissions.IAM_ROLE_MANAGE)
  async permissions(): Promise<{ success: true; data: Permission[] }> {
    const data = await this.service.getAllPermissions();
    return { success: true as const, data };
  }
}
