/**
 * Generic Module Data Routes
 * For dynamic modules that don't have specific routes.
 * Uses RBAC requirePermission middleware based on moduleId.
 */

import express, { Request, Response } from 'express';
import { authenticate } from '../middleware/auth';
import { authenticateJwtOrApiToken } from '../middleware/dualAuth';
import { requirePermission } from '../middleware/permissions';
import { ModuleData } from '../models/ModuleData';

const router = express.Router();

router.use(authenticateJwtOrApiToken);

// Get module data for a company (requires view permission)
router.get('/:moduleId/:companyId', requirePermission('', 'view'), async (req: Request, res: Response) => {
  try {
    const { moduleId, companyId } = req.params;

    if (!req.user!.companyIds.includes(companyId) && req.user!.role !== 'admin') {
      res.status(403).json({ error: 'Access denied' });
      return;
    }

    const data = await ModuleData.findOne({ moduleId, companyId });
    if (!data) {
      res.json({});
      return;
    }
    // Include document _id as id in the response so module data items have an identifier
    const result = { ...data.data, id: data._id?.toString?.() || data._id };
    res.json(result);
  } catch (error) {
    res.status(500).json({ error: 'Failed to get module data' });
  }
});

// Save module data (requires edit permission)
router.post(
  '/:moduleId',
  requirePermission('', 'edit'),
  async (req: Request, res: Response) => {
    try {
      const { moduleId } = req.params;
      const { companyId, data } = req.body;

      if (!req.user!.companyIds.includes(companyId) && req.user!.role !== 'admin') {
        res.status(403).json({ error: 'Access denied' });
        return;
      }

      const moduleData = await ModuleData.findOneAndUpdate(
        { moduleId, companyId },
        { moduleId, companyId, data },
        { upsert: true, new: true }
      );

      res.json(moduleData.data);
    } catch (error) {
      res.status(500).json({ error: 'Failed to save module data' });
    }
  }
);

// Delete module data (requires delete permission)
router.delete('/:moduleId/:companyId', requirePermission('', 'delete'), async (req: Request, res: Response) => {
  try {
    const { moduleId, companyId } = req.params;

    if (!req.user!.companyIds.includes(companyId) && req.user!.role !== 'admin') {
      res.status(403).json({ error: 'Access denied' });
      return;
    }

    await ModuleData.findOneAndDelete({ moduleId, companyId });
    res.json({ message: 'Module data deleted successfully' });
  } catch (error) {
    res.status(500).json({ error: 'Failed to delete module data' });
  }
});

export default router;