import { Router } from 'express';

import { authenticate } from '../../middlewares/auth.middleware';
import { requirePermission } from '../../middlewares/rbac.middleware';

import { rbacController } from './rbac.controller';

/**
 * EN: Create and configure RBAC routes
 * VI: Tạo và cấu hình routes cho RBAC
 */
export const createRbacRouter = (): Router => {
    const router = Router();

    /**
     * @swagger
     * /api/{version}/rbac/permissions:
     *   get:
     *     summary: Get user permissions
     *     description: Get list of permissions assigned to the current user
     *     tags: [RBAC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     responses:
     *       200:
     *         description: Permissions retrieved successfully
     *         content:
     *           application/json:
     *             schema:
     *               allOf:
     *                 - $ref: '#/components/schemas/ApiResponse'
     *                 - type: object
     *                   properties:
     *                     data:
     *                       type: array
     *                       items:
     *                         type: string
     *       401:
     *         description: Unauthorized
     */
    router.get('/permissions', authenticate(), rbacController.getUserPermissions.bind(rbacController));

    /**
     * @swagger
     * /api/{version}/rbac/roles/assign:
     *   post:
     *     summary: Assign role to user
     *     description: Assign a specific role to a user. Requires 'rbac:assign' permission.
     *     tags: [RBAC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [userId, roleId]
     *             properties:
     *               userId:
     *                 type: string
     *               roleId:
     *                 type: string
     *     responses:
     *       200:
     *         description: Role assigned successfully
     *         content:
     *           application/json:
     *             schema:
     *               $ref: '#/components/schemas/ApiResponse'
     *       401:
     *         description: Unauthorized
     *       403:
     *         description: Forbidden - Insufficient permissions
     *       404:
     *         description: User or Role not found
     */
    router.post('/roles/assign', authenticate(), requirePermission('rbac', 'assign'), rbacController.assignRole.bind(rbacController));

    /**
     * @swagger
     * /api/{version}/rbac/roles/revoke:
     *   post:
     *     summary: Revoke role from user
     *     description: Revoke a specific role from a user. Requires 'rbac:revoke' permission.
     *     tags: [RBAC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [userId, roleId]
     *             properties:
     *               userId:
     *                 type: string
     *               roleId:
     *                 type: string
     *     responses:
     *       200:
     *         description: Role revoked successfully
     *         content:
     *           application/json:
     *             schema:
     *               $ref: '#/components/schemas/ApiResponse'
     *       401:
     *         description: Unauthorized
     *       403:
     *         description: Forbidden - Insufficient permissions
     *       404:
     *         description: User or Role not found
     */
    router.post('/roles/revoke', authenticate(), requirePermission('rbac', 'revoke'), rbacController.revokeRole.bind(rbacController));

    /**
     * @swagger
     * /api/{version}/rbac/permissions/grant:
     *   post:
     *     summary: Grant permission to role
     *     description: Grant a specific permission to a role. Requires 'rbac:grant' permission.
     *     tags: [RBAC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *     requestBody:
     *       required: true
     *       content:
     *         application/json:
     *           schema:
     *             type: object
     *             required: [roleId, permissionId]
     *             properties:
     *               roleId:
     *                 type: string
     *               permissionId:
     *                 type: string
     *     responses:
     *       200:
     *         description: Permission granted successfully
     *         content:
     *           application/json:
     *             schema:
     *               $ref: '#/components/schemas/ApiResponse'
     *       401:
     *         description: Unauthorized
     *       403:
     *         description: Forbidden - Insufficient permissions
     *       404:
     *         description: Role or Permission not found
     */
    router.post('/permissions/grant', authenticate(), requirePermission('rbac', 'grant'), rbacController.grantPermission.bind(rbacController));

    /**
     * @swagger
     * /api/{version}/rbac/permissions/check:
     *   get:
     *     summary: Check permission
     *     description: Check if the current user has a specific permission
     *     tags: [RBAC]
     *     security:
     *       - bearerAuth: []
     *     parameters:
     *       - in: path
     *         name: version
     *         required: true
     *         schema:
     *           type: string
     *           default: v1
     *         description: API version
     *       - in: query
     *         name: resource
     *         required: true
     *         schema:
     *           type: string
     *       - in: query
     *         name: action
     *         required: true
     *         schema:
     *           type: string
     *     responses:
     *       200:
     *         description: Permission check result
     *         content:
     *           application/json:
     *             schema:
     *               allOf:
     *                 - $ref: '#/components/schemas/ApiResponse'
     *                 - type: object
     *                   properties:
     *                     data:
     *                       type: object
     *                       properties:
     *                         allowed:
     *                           type: boolean
     *       401:
     *         description: Unauthorized
     *       403:
     *         description: Forbidden
     */
    router.get('/permissions/check', authenticate(), rbacController.checkPermission.bind(rbacController));


    // EN: Role Management Routes
    // VI: Routes Quản Lý Role
    router.get("/roles", authenticate(), requirePermission("rbac", "read"), rbacController.getRoles.bind(rbacController));
    router.post("/roles", authenticate(), requirePermission("rbac", "create"), rbacController.createRole.bind(rbacController));
    router.post("/check", authenticate(), rbacController.checkPermission.bind(rbacController));

    return router;
};
