import { Router } from 'express';
import { purchasesController } from './purchases.controller.js';
import { authenticate } from '../../shared/middleware/auth.middleware.js';
import { requireAccess } from '../../shared/middleware/rbac.middleware.js';

const router = Router();

// All routes require authentication
router.use(authenticate);

// List purchase orders
router.get('/', requireAccess({ roles: ['admin', 'manager', 'warehouse', 'accountant'], permission: 'purchases:read' }), (req, res, next) =>
  purchasesController.findAll(req, res, next)
);

// Get purchase order by ID
router.get('/:id', requireAccess({ roles: ['admin', 'manager', 'warehouse', 'accountant'], permission: 'purchases:read' }), (req, res, next) =>
  purchasesController.findById(req, res, next)
);

// Create purchase order
router.post('/', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchases:create' }), (req, res, next) =>
  purchasesController.create(req, res, next)
);

// Update purchase order
router.put('/:id', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchases:update' }), (req, res, next) =>
  purchasesController.update(req, res, next)
);

// Confirm purchase order
router.post('/:id/confirm', requireAccess({ roles: ['admin', 'manager'], permission: 'purchases:approve' }), (req, res, next) =>
  purchasesController.confirm(req, res, next)
);

// Cancel purchase order
router.post('/:id/cancel', requireAccess({ roles: ['admin', 'manager'], permission: 'purchases:cancel' }), (req, res, next) =>
  purchasesController.cancel(req, res, next)
);

// Delete purchase order
router.delete('/:id', requireAccess({ roles: ['admin'], permission: 'purchases:delete' }), (req, res, next) =>
  purchasesController.delete(req, res, next)
);

// ========== RFQs (Request for Quotation) ==========
router.get('/rfqs', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:read' }), (req, res, next) =>
  purchasesController.getRfqs(req, res, next)
);
router.get('/rfqs/:id', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:read' }), (req, res, next) =>
  purchasesController.getRfq(req, res, next)
);
router.post('/rfqs', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:create' }), (req, res, next) =>
  purchasesController.createRfq(req, res, next)
);
router.put('/rfqs/:id', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:update' }), (req, res, next) =>
  purchasesController.updateRfq(req, res, next)
);
router.delete('/rfqs/:id', requireAccess({ roles: ['admin'], permission: 'purchase_orders:delete' }), (req, res, next) =>
  purchasesController.deleteRfq(req, res, next)
);

// RFQ Lines
router.post('/rfqs/:id/lines', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:update' }), (req, res, next) =>
  purchasesController.addRfqLine(req, res, next)
);
router.put('/rfqs/:id/lines/:lineId', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:update' }), (req, res, next) =>
  purchasesController.updateRfqLine(req, res, next)
);
router.delete('/rfqs/:id/lines/:lineId', requireAccess({ roles: ['admin', 'manager', 'warehouse'], permission: 'purchase_orders:update' }), (req, res, next) =>
  purchasesController.removeRfqLine(req, res, next)
);

// RFQ Workflow
router.post('/rfqs/:id/send', requireAccess({ roles: ['admin', 'manager'], permission: 'purchase_orders:approve' }), (req, res, next) =>
  purchasesController.sendRfq(req, res, next)
);
router.post('/rfqs/:id/responded', requireAccess({ roles: ['admin', 'manager'], permission: 'purchase_orders:update' }), (req, res, next) =>
  purchasesController.markRfqResponded(req, res, next)
);
router.post('/rfqs/:id/accept', requireAccess({ roles: ['admin', 'manager'], permission: 'purchase_orders:approve' }), (req, res, next) =>
  purchasesController.acceptRfq(req, res, next)
);
router.post('/rfqs/:id/reject', requireAccess({ roles: ['admin', 'manager'], permission: 'purchase_orders:reject' }), (req, res, next) =>
  purchasesController.rejectRfq(req, res, next)
);
router.post('/rfqs/:id/cancel', requireAccess({ roles: ['admin', 'manager'], permission: 'purchase_orders:delete' }), (req, res, next) =>
  purchasesController.cancelRfq(req, res, next)
);

export default router;
