import {
  Body,
  Controller,
  Get,
  Param,
  Patch,
  Post,
  Query,
  Req,
  Delete,
  UseGuards,
} from '@nestjs/common';
import { OperationLog } from '../audit/operation-log.decorator';
import { AuthGuard } from '../auth/auth.guard';
import type { AuthenticatedRequest } from '../auth/types/authenticated-request';
import { AdminUsersService } from './admin-users.service';
import type {
  AssignUserRoleDto,
  CreateAdminUserDto,
  UpdateAdminUserDto,
  UpdateUserEnabledDto,
  UpdateUserPermissionsDto,
} from './dto/admin-user.dto';

@UseGuards(AuthGuard)
@Controller('api/admin')
export class AdminUsersController {
  constructor(private readonly adminUsersService: AdminUsersService) {}

  @Get('roles')
  listRoles(@Req() request: AuthenticatedRequest) {
    return this.adminUsersService.listRoles(request.user);
  }

  @Get('users')
  listUsers(
    @Req() request: AuthenticatedRequest,
    @Query() query: Record<string, unknown>,
  ) {
    return this.adminUsersService.listUsers(request.user, query);
  }

  @Post('users')
  @OperationLog({
    action: 'admin.users.create',
    resourceType: 'user',
    resourceIdFromResult: 'id',
    metadataFromBody: ['name', 'email', 'roleCode', 'parentId', 'mustChangePassword'],
    description: '新建用户',
  })
  createUser(
    @Req() request: AuthenticatedRequest,
    @Body() dto: CreateAdminUserDto,
  ) {
    return this.adminUsersService.createUser(request.user, dto);
  }

  @Patch('users/:id/enabled')
  @OperationLog({
    action: 'admin.users.update_enabled',
    resourceType: 'user',
    resourceIdParam: 'id',
    metadataFromBody: ['enabled'],
    description: '更新用户启停状态',
  })
  updateEnabled(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
    @Body() dto: UpdateUserEnabledDto,
  ) {
    return this.adminUsersService.updateEnabled(request.user, id, dto);
  }

  @Patch('users/:id')
  @OperationLog({
    action: 'admin.users.update',
    resourceType: 'user',
    resourceIdParam: 'id',
    metadataFromBody: ['name', 'email', 'roleCode', 'enabled', 'mustChangePassword'],
    description: '编辑用户信息',
  })
  updateUser(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
    @Body() dto: UpdateAdminUserDto,
  ) {
    return this.adminUsersService.updateUser(request.user, id, dto);
  }

  @Patch('users/:id/role')
  @OperationLog({
    action: 'admin.users.assign_role',
    resourceType: 'user',
    resourceIdParam: 'id',
    metadataFromBody: ['roleCode'],
    description: '调整用户角色',
  })
  assignRole(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
    @Body() dto: AssignUserRoleDto,
  ) {
    return this.adminUsersService.assignRole(request.user, id, dto);
  }

  @Get('users/:id/permissions')
  getUserPermissions(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
  ) {
    return this.adminUsersService.getUserPermissions(request.user, id);
  }

  @Patch('users/:id/permissions')
  @OperationLog({
    action: 'admin.users.update_permissions',
    resourceType: 'user',
    resourceIdParam: 'id',
    metadataFromBody: ['permissions'],
    description: '设置用户权限',
  })
  updateUserPermissions(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
    @Body() dto: UpdateUserPermissionsDto,
  ) {
    return this.adminUsersService.updateUserPermissions(request.user, id, dto);
  }

  @Delete('users/:id/permissions')
  @OperationLog({
    action: 'admin.users.reset_permissions',
    resourceType: 'user',
    resourceIdParam: 'id',
    description: '恢复用户默认权限',
  })
  resetUserPermissions(
    @Req() request: AuthenticatedRequest,
    @Param('id') id: string,
  ) {
    return this.adminUsersService.resetUserPermissions(request.user, id);
  }
}
