import { Router } from 'express';
import { requireAuth } from '../middleware/auth';
import {
  listWalkInQRs,
  createWalkInQR,
  updateWalkInQR,
  deleteWalkInQR,
  getPublicWalkInQR,
  submitPublicWalkInQR,
} from '../controllers/walkInQR.controller';

// Authenticated CRUD — read open to any authed user. Writes are gated per
// action inside the controller (owner always; sub-admins need
// canAddWalkInQr / canDeleteWalkInQr — DB-looked-up so grants apply without
// re-login, mirroring the visitor Add/Delete permissions).
export const walkInQRRoutes = Router();
walkInQRRoutes.get('/', requireAuth, listWalkInQRs);
walkInQRRoutes.post('/', requireAuth, createWalkInQR);
walkInQRRoutes.patch('/:id', requireAuth, updateWalkInQR);
walkInQRRoutes.delete('/:id', requireAuth, deleteWalkInQR);

// Public (no auth) — the walk-in visitor's phone hits these.
export const publicWalkInRoutes = Router();
publicWalkInRoutes.get('/:code', getPublicWalkInQR);
publicWalkInRoutes.post('/:code', submitPublicWalkInQR);