import { Router } from 'express';
import { requireAuth, requireOwnerOrSubAdminManager, requireAuthOrPlatform, requireFlag, requireAnyAuth } from '../middleware/auth';
import {
  adminMe, listAdmins, createAdmin, updateAdmin, deleteAdmin,
} from '../controllers/admin.controller';
import {
  listVisitors,
  createVisitor,
  bulkCreateVisitors,
  getVisitor,
  getVisitorByShortId,
  getVisitorEditHistory,
  updateVisitor,
  checkoutVisitor,
  deleteVisitor,
  listVisitorCheckpoints,
  createVisitorCheckpoint,
  updateVisitorCheckpoint,
  deleteVisitorCheckpoint,
  listVisitorRequests,
  approveVisitorRequest,
  rejectVisitorRequest,
  approveVisitorScan,
  rejectVisitorScan,
  getCheckpointHistory,
  getOwnerCounts,
  listVisitorWhatsAppTemplates,
  sendVisitorWhatsAppTemplate,
} from '../controllers/visitors.controller';
import {
  listApprovers,
  createApprover,
  updateApprover,
  deleteApprover,
  getApproverHistory,
  listAllApproverActivity,
} from '../controllers/approver.controller';
import { ownerNotifications } from '../controllers/notifications.controller';
import { registerDevice, unregisterDevice } from '../controllers/devices.controller';
import { deleteOwnAccount } from '../controllers/account.controller';
import {
  listVisitorReasons, createVisitorReason, updateVisitorReason, deleteVisitorReason,
} from '../controllers/visitorReasons.controller';

const router = Router();

// Reason-for-visit presets (managed in Settings, used by the add-visitor +
// scanner walk-in forms as a dropdown).
router.get('/reasons', requireAuth, listVisitorReasons);
router.post('/reasons', requireAuth, requireFlag('canManageSettings'), createVisitorReason);
router.put('/reasons/:id', requireAuth, requireFlag('canManageSettings'), updateVisitorReason);
router.delete('/reasons/:id', requireAuth, requireFlag('canManageSettings'), deleteVisitorReason);

// Sub-admin self profile (admin's own JWT)
router.get('/admin-me', requireAuth, adminMe);
// Admin management. Owner sees + edits all admins. An admin with
// canManageSubAdmins also lands here but the controllers scope each
// action to admins they themselves created (their receptionists).
router.get('/admins', requireAuth, requireOwnerOrSubAdminManager, listAdmins);
router.post('/admins', requireAuth, requireOwnerOrSubAdminManager, createAdmin);
router.put('/admins/:id', requireAuth, requireOwnerOrSubAdminManager, updateAdmin);
router.delete('/admins/:id', requireAuth, requireOwnerOrSubAdminManager, deleteAdmin);

// Platform-admin tokens are also accepted on these read paths so the
// vendor console can show cross-org views without a separate endpoint
// set. Mutating endpoints (POST/PUT/DELETE below) stay customer-only.
router.get('/', requireAuthOrPlatform, listVisitors);
router.get('/counts', requireAuthOrPlatform, getOwnerCounts);
router.post('/', requireAuth, createVisitor);
router.post('/bulk', requireAuth, bulkCreateVisitors);
router.get('/approvers', requireAuth, listApprovers);
router.post('/approvers', requireAuth, requireFlag('canManageApprovers'), createApprover);
router.get('/approvers/activity', requireAuth, listAllApproverActivity);
router.put('/approvers/:id', requireAuth, requireFlag('canManageApprovers'), updateApprover);
router.delete('/approvers/:id', requireAuth, requireFlag('canManageApprovers'), deleteApprover);
router.get('/approvers/:id/history', requireAuth, getApproverHistory);

// Notifications (owner-scoped)
// Device push tokens — mobile app registers on launch. requireAnyAuth so
// checkpoint (reception scanner) sessions can register for push too.
router.post('/devices/register', requireAnyAuth, registerDevice);
router.post('/devices/unregister', requireAnyAuth, unregisterDevice);

// Apple App Store requires an in-app account-deletion path.
router.delete('/account', requireAuth, deleteOwnAccount);

router.get('/notifications', requireAuth, ownerNotifications.list);
router.post('/notifications/read-all', requireAuth, ownerNotifications.markAllRead);
router.post('/notifications/:id/read', requireAuth, ownerNotifications.markRead);
router.get('/checkpoints', requireAuth, listVisitorCheckpoints);
router.post('/checkpoints', requireAuth, requireFlag('canManageSettings'), createVisitorCheckpoint);
router.put('/checkpoints/:id', requireAuth, requireFlag('canManageSettings'), updateVisitorCheckpoint);
router.delete('/checkpoints/:id', requireAuth, requireFlag('canManageSettings'), deleteVisitorCheckpoint);
router.get('/checkpoints/:id/history', requireAuth, getCheckpointHistory);
router.get('/requests', requireAuth, listVisitorRequests);
router.post('/requests/:id/approve', requireAuth, approveVisitorRequest);
router.post('/requests/:id/reject', requireAuth, rejectVisitorRequest);
router.post('/:id/approve-scan', requireAuth, approveVisitorScan);
router.post('/:id/reject-scan', requireAuth, rejectVisitorScan);
router.get('/by-short-id/:shortId', requireAuth, getVisitorByShortId);
router.get('/:id', requireAuth, getVisitor);
router.get('/:id/history', requireAuth, getVisitorEditHistory);
router.get('/:id/whatsapp-templates', requireAuth, listVisitorWhatsAppTemplates);
router.post('/:id/whatsapp-send', requireAuth, sendVisitorWhatsAppTemplate);
router.put('/:id', requireAuth, updateVisitor);
router.post('/:id/checkout', requireAuth, checkoutVisitor);
router.delete('/:id', requireAuth, deleteVisitor);

export default router;