/**
 * @swagger
 * tags:
 *   name: SolaceNet Entitlements
 *   description: Entitlement management - manage tenant/program/region/channel entitlements
 */

import { Router } from 'express';
import { zeroTrustAuthMiddleware } from '@/integration/api-gateway/middleware/auth.middleware';
import { entitlementsService } from './entitlements.service';
import { CreateEntitlementRequest, EntitlementCheckContext } from '@/shared/solacenet/types';

const router = Router();

/**
 * @swagger
 * /api/v1/solacenet/tenants/{tenantId}/programs/{programId}/entitlements:
 *   get:
 *     summary: Get entitlements for tenant/program
 *     description: Get all entitlements for a tenant and optional program
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     parameters:
 *       - in: path
 *         name: tenantId
 *         required: true
 *         schema:
 *           type: string
 *       - in: path
 *         name: programId
 *         required: false
 *         schema:
 *           type: string
 *     responses:
 *       200:
 *         description: List of entitlements
 */
router.get('/tenants/:tenantId/programs/:programId?/entitlements', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const { tenantId, programId } = req.params;
    const entitlements = await entitlementsService.getEntitlements(tenantId, programId);
    res.json(entitlements);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/entitlements/check:
 *   post:
 *     summary: Check entitlement
 *     description: Check if an entitlement exists for a given context
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             required:
 *               - tenantId
 *               - capabilityId
 *             properties:
 *               tenantId:
 *                 type: string
 *               programId:
 *                 type: string
 *               capabilityId:
 *                 type: string
 *               region:
 *                 type: string
 *               channel:
 *                 type: string
 *               actor:
 *                 type: string
 *     responses:
 *       200:
 *         description: Entitlement check result
 */
router.post('/entitlements/check', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const context = req.body as EntitlementCheckContext;
    const entitlement = await entitlementsService.checkEntitlement(context);
    res.json({ found: !!entitlement, entitlement });
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/entitlements:
 *   post:
 *     summary: Create entitlement
 *     description: Create a new entitlement
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             required:
 *               - tenantId
 *               - capabilityId
 *             properties:
 *               tenantId:
 *                 type: string
 *               programId:
 *                 type: string
 *               capabilityId:
 *                 type: string
 *               region:
 *                 type: string
 *               channel:
 *                 type: string
 *               stateOverride:
 *                 type: string
 *                 enum: [disabled, pilot, enabled, suspended, drain]
 *               allowlist:
 *                 type: array
 *                 items:
 *                   type: string
 *               effectiveFrom:
 *                 type: string
 *                 format: date-time
 *               effectiveTo:
 *                 type: string
 *                 format: date-time
 *     responses:
 *       201:
 *         description: Entitlement created
 */
router.post('/entitlements', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const request = req.body as CreateEntitlementRequest;
    const entitlement = await entitlementsService.createEntitlement(request);
    res.status(201).json(entitlement);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/entitlements:
 *   put:
 *     summary: Bulk update entitlements
 *     description: Bulk update multiple entitlements (admin-only)
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             properties:
 *               updates:
 *                 type: array
 *                 items:
 *                   type: object
 *                   properties:
 *                     id:
 *                       type: string
 *                     updates:
 *                       type: object
 *     responses:
 *       200:
 *         description: Entitlements updated
 */
router.put('/entitlements', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const { updates } = req.body;
    const entitlements = await entitlementsService.bulkUpdateEntitlements(updates);
    res.json(entitlements);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/entitlements/{id}:
 *   put:
 *     summary: Update entitlement
 *     description: Update an existing entitlement
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema:
 *           type: string
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *     responses:
 *       200:
 *         description: Entitlement updated
 */
router.put('/entitlements/:id', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    const updates = req.body;
    const entitlement = await entitlementsService.updateEntitlement(req.params.id, updates);
    res.json(entitlement);
  } catch (error) {
    next(error);
  }
});

/**
 * @swagger
 * /api/v1/solacenet/entitlements/{id}:
 *   delete:
 *     summary: Delete entitlement
 *     description: Delete an entitlement
 *     tags: [SolaceNet Entitlements]
 *     security:
 *       - SovereignToken: []
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema:
 *           type: string
 *     responses:
 *       204:
 *         description: Entitlement deleted
 */
router.delete('/entitlements/:id', zeroTrustAuthMiddleware, async (req, res, next) => {
  try {
    await entitlementsService.deleteEntitlement(req.params.id);
    res.status(204).send();
  } catch (error) {
    next(error);
  }
});

export default router;
