import {
  Controller,
  Get,
  Post,
  Patch,
  Put,
  Delete,
  Body,
  Param,
  Query,
  UseGuards,
  ParseUUIDPipe,
} from '@nestjs/common';
import { RoleService } from './role.service';
import { RoleHierarchyService } from './role-hierarchy.service';
import { CreateRoleDto, UpdateRoleDto, AssignPermissionsDto } from './dto';
import { UpdateRoleHierarchyDto } from './dto/update-role-hierarchy.dto';
import { JwtAuthGuard } from '../../auth/guards/jwt-auth.guard';
import { PermissionGuard } from '../../auth/guards/permission.guard';
import { Permissions } from '../../auth/decorators/permissions.decorator';
import { AccessLevel, ModuleName } from '../../entities/role-permission.entity';
import { paginatedResponse, successResponse } from '../../common/responses/api-response';
import { PaginationDto } from '../../common/dto/pagination.dto';
import { Lookup } from '../../common/decorators/lookup.decorator';

/**
 * RoleController — CRUD for roles + permission assignment.
 *
 * Per CLAUDE.md:
 * - Controller has ZERO tenant awareness
 * - No setTenantId() calls — CLS handles everything
 * - On permission update → always invalidate Redis cache (handled by service)
 */
@Controller('roles')
@UseGuards(JwtAuthGuard, PermissionGuard)
export class RoleController {
  constructor(
    private readonly roleService: RoleService,
    private readonly hierarchyService: RoleHierarchyService,
  ) {}

  @Get()
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.VIEW })
  async findAll(@Query() query: PaginationDto) {
    const { items, meta } = await this.roleService.findAll(query);
    return paginatedResponse(items, meta, 'Roles fetched successfully');
  }

  @Get('lookup')
  @Lookup()
  async lookup() {
    const items = await this.roleService.findAllForLookup();
    return successResponse(items, 'Roles lookup');
  }

  @Get('hierarchy')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.VIEW })
  async getHierarchy() {
    const data = await this.hierarchyService.get();
    return successResponse(data, 'Role hierarchy fetched successfully');
  }

  @Put('hierarchy')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.EDIT })
  async updateHierarchy(@Body() dto: UpdateRoleHierarchyDto) {
    const result = await this.hierarchyService.replace(dto);
    return successResponse(result, result.message);
  }

  @Get(':id')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.VIEW })
  async findById(@Param('id', ParseUUIDPipe) id: string) {
    const data = await this.roleService.findById(id);
    return successResponse(data, 'Role fetched successfully');
  }

  @Get(':id/permissions')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.VIEW })
  async getPermissionsMatrix(@Param('id', ParseUUIDPipe) id: string) {
    const data = await this.roleService.getPermissionsMatrix(id);
    return successResponse(data, 'Permissions fetched successfully');
  }

  @Post()
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.CREATE })
  async create(@Body() dto: CreateRoleDto) {
    const result = await this.roleService.create(dto);
    return successResponse(result, result.message);
  }

  @Patch(':id')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.EDIT })
  async update(@Param('id', ParseUUIDPipe) id: string, @Body() dto: UpdateRoleDto) {
    const result = await this.roleService.update(id, dto);
    return successResponse(result, result.message);
  }

  @Patch(':id/permissions')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.EDIT })
  async assignPermissions(
    @Param('id', ParseUUIDPipe) id: string,
    @Body() dto: AssignPermissionsDto,
  ) {
    const result = await this.roleService.assignPermissions(id, dto);
    return successResponse(result, result.message);
  }

  @Delete(':id')
  @Permissions({ module: ModuleName.SETTINGS, accessLevel: AccessLevel.DELETE })
  async remove(@Param('id', ParseUUIDPipe) id: string) {
    const result = await this.roleService.remove(id);
    return successResponse(result, result.message);
  }
}