/**
 * @swagger
 * tags:
 *   name: SolaceNet Policy Engine
 *   description: Policy decision engine - runtime capability decisions
 */

import { Router } from 'express';
import { zeroTrustAuthMiddleware } from '@/integration/api-gateway/middleware/auth.middleware';
import { policyEngineService } from './policy-engine.service';
import { PolicyDecisionRequest, CreatePolicyRuleRequest } from '@/shared/solacenet/types';

const router = Router();

/**
 * @swagger
 * /api/v1/solacenet/policy/decide:
 *   post:
 *     summary: Make policy decision
 *     description: Main endpoint for policy decisions - checks entitlements and rules
 *     tags: [SolaceNet Policy Engine]
 *     security:
 *       - SovereignToken: []
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             required:
 *               - tenantId
 *               - capabilityId
 *             properties:
 *               tenantId:
 *                 type: string
 *               programId:
 *                 type: string
 *               capabilityId:
 *                 type: string
 *               region:
 *                 type: string
 *               channel:
 *                 type: string
 *               actor:
 *                 type: string
 *               context:
 *                 type: object
 *     responses:
 *       200:
 *         description: Policy decision
 */
router.post('/decide', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const request = req.body as PolicyDecisionRequest;
    const decision = await policyEngineService.decide(request);
    res.json(decision);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/policy/rules:
 *   get:
 *     summary: List policy rules
 *     description: Get all policy rules, optionally filtered by capability
 *     tags: [SolaceNet Policy Engine]
 *     security:
 *       - SovereignToken: []
 *     parameters:
 *       - in: query
 *         name: capabilityId
 *         schema:
 *           type: string
 *     responses:
 *       200:
 *         description: List of policy rules
 */
router.get('/rules', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const capabilityId = req.query.capabilityId as string | undefined;
    const rules = await policyEngineService.getPolicyRules(capabilityId);
    res.json(rules);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/policy/rules:
 *   post:
 *     summary: Create policy rule
 *     description: Create a new policy rule
 *     tags: [SolaceNet Policy Engine]
 *     security:
 *       - SovereignToken: []
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             required:
 *               - ruleId
 *               - capabilityId
 *               - scope
 *               - condition
 *               - decision
 *             properties:
 *               ruleId:
 *                 type: string
 *               capabilityId:
 *                 type: string
 *               scope:
 *                 type: string
 *                 enum: [tenant, program, region, channel, global]
 *               scopeValue:
 *                 type: string
 *               condition:
 *                 type: object
 *               decision:
 *                 type: string
 *                 enum: [allow, deny, limit]
 *               limits:
 *                 type: object
 *               reason:
 *                 type: string
 *               ticket:
 *                 type: string
 *               priority:
 *                 type: number
 *     responses:
 *       201:
 *         description: Policy rule created
 */
router.post('/rules', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const request = req.body as CreatePolicyRuleRequest;
    const rule = await policyEngineService.createPolicyRule(request);
    res.status(201).json(rule);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/policy/kill-switch/{capabilityId}:
 *   post:
 *     summary: Activate kill switch
 *     description: Emergency kill switch - immediately disables capability and invalidates cache
 *     tags: [SolaceNet Policy Engine]
 *     security:
 *       - SovereignToken: []
 *     parameters:
 *       - in: path
 *         name: capabilityId
 *         required: true
 *         schema:
 *           type: string
 *     requestBody:
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             properties:
 *               reason:
 *                 type: string
 *     responses:
 *       200:
 *         description: Kill switch activated
 */
router.post('/kill-switch/:capabilityId', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const { capabilityId } = req.params;
    const { reason } = req.body;
    await policyEngineService.activateKillSwitch(capabilityId, reason);
    res.json({ message: 'Kill switch activated', capabilityId });
  } catch (error) {
    next(error);
  }
});

export default router;
