import { Router } from 'express';
import { requireAuth, requireFlag } from '../middleware/auth';
import {
  listDepartments,
  createDepartment,
  updateDepartment,
  deleteDepartment,
} from '../controllers/departments.controller';

const router = Router();

// Reads open to any authed user in the workspace. Writes gated on
// canManageSettings so a read-only sub-admin (Bob) can't change taxonomy.
router.get('/', requireAuth, listDepartments);
router.post('/', requireAuth, requireFlag('canManageSettings'), createDepartment);
router.put('/:id', requireAuth, requireFlag('canManageSettings'), updateDepartment);
router.delete('/:id', requireAuth, requireFlag('canManageSettings'), deleteDepartment);

export default router;