import {
  Body,
  Controller,
  Get,
  Headers,
  Param,
  Post,
  Query,
  UseGuards,
} from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';
import { OnboardingService } from './onboarding.service';
import { RegisterVerantwortlicheDto } from './dto/register-verantwortliche.dto';
import { Roles } from '../common/roles.decorator';
import { RolesGuard } from '../common/roles.guard';
import { Role } from '../common/role.enum';

function bearer(header?: string): string | undefined {
  return header?.startsWith('Bearer ') ? header.slice('Bearer '.length) : undefined;
}

@Controller('onboarding')
export class OnboardingController {
  constructor(private readonly onboarding: OnboardingService) {}

  /// Public lookup: invite code -> KC name + selectable Gemeinden.
  @Get('kc/:inviteCode')
  resolveInvite(@Param('inviteCode') inviteCode: string) {
    return this.onboarding.resolveInvite(inviteCode);
  }

  /// Self-registration as Gemeinde Verantwortliche/r. Authenticated by the
  /// caller's raw Authentik bearer token (no local Membership required yet).
  @Post('verantwortliche')
  registerVerantwortliche(
    @Body() dto: RegisterVerantwortlicheDto,
    @Headers('authorization') authorization?: string,
  ) {
    return this.onboarding.registerVerantwortliche(
      bearer(authorization),
      dto.inviteCode,
      dto.gemeindeId,
    );
  }

  /// Leitungsteam: review and act on pending self-registrations.
  @Get('requests')
  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
  @Roles(Role.LEITUNGSTEAM)
  listRequests(@Query('kcId') kcId: string) {
    return this.onboarding.listRequests(kcId);
  }

  @Post('requests/:membershipId/approve')
  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
  @Roles(Role.LEITUNGSTEAM)
  approve(@Param('membershipId') membershipId: string) {
    return this.onboarding.approve(membershipId);
  }

  @Post('requests/:membershipId/reject')
  @UseGuards(AuthGuard(['authentik', 'team']), RolesGuard)
  @Roles(Role.LEITUNGSTEAM)
  reject(@Param('membershipId') membershipId: string) {
    return this.onboarding.reject(membershipId);
  }
}