package com.zioinfo.kintex.system.sysuser;

import com.zioinfo.kintex.auth.KintexPrincipal;
import com.zioinfo.kintex.common.ApiResponse;
import com.zioinfo.kintex.common.PageResponse;
import com.zioinfo.kintex.common.audit.Audited;
import com.zioinfo.kintex.system.SystemAccessGuard;
import jakarta.validation.Valid;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.*;

/** 시스템관리 — 사용자 관리 API (/api/admin/users). ADMIN 게이트. kintex-admin-dev 백오피스 공통 백엔드. */
@RestController
@RequestMapping("/api/admin/users")
public class SysUserController {

    private final SysUserService service;
    private final SystemAccessGuard guard;

    public SysUserController(SysUserService service, SystemAccessGuard guard) {
        this.service = service;
        this.guard = guard;
    }

    @GetMapping
    public ApiResponse<PageResponse<SysUserDto>> list(
            @AuthenticationPrincipal KintexPrincipal principal,
            @RequestParam(required = false) String keyword,
            @RequestParam(required = false) String status,
            @RequestParam(required = false) String roleCode,
            @RequestParam(defaultValue = "0") int page,
            @RequestParam(defaultValue = "20") int size) {
        guard.requireAdmin(principal);
        return ApiResponse.ok(service.list(keyword, status, roleCode, page, size));
    }

    @GetMapping("/{userId}")
    public ApiResponse<SysUserDto> get(@AuthenticationPrincipal KintexPrincipal principal,
                                       @PathVariable String userId) {
        guard.requireAdmin(principal);
        return ApiResponse.ok(service.get(userId));
    }

    @Audited(action = "SYS_USER_CREATE", targetType = "app_user")
    @PostMapping
    public ApiResponse<SysUserDto> create(@AuthenticationPrincipal KintexPrincipal principal,
                                          @Valid @RequestBody UserSaveRequest req) {
        guard.requireAdmin(principal);
        return ApiResponse.ok(service.create(req));
    }

    @Audited(action = "SYS_USER_UPDATE", targetType = "app_user")
    @PutMapping("/{userId}")
    public ApiResponse<SysUserDto> update(@AuthenticationPrincipal KintexPrincipal principal,
                                          @PathVariable String userId,
                                          @Valid @RequestBody UserSaveRequest req) {
        guard.requireAdmin(principal);
        return ApiResponse.ok(service.update(userId, req));
    }

    @Audited(action = "SYS_USER_STATUS", targetType = "app_user")
    @PatchMapping("/{userId}/status")
    public ApiResponse<Void> status(@AuthenticationPrincipal KintexPrincipal principal,
                                    @PathVariable String userId, @RequestParam String value) {
        guard.requireAdmin(principal);
        service.changeStatus(userId, value);
        return ApiResponse.ok(null);
    }

    @Audited(action = "SYS_USER_PW_RESET", targetType = "app_user")
    @PostMapping("/{userId}/password")
    public ApiResponse<Void> resetPassword(@AuthenticationPrincipal KintexPrincipal principal,
                                           @PathVariable String userId,
                                           @Valid @RequestBody PasswordResetRequest req) {
        guard.requireAdmin(principal);
        service.resetPassword(userId, req.newPassword());
        return ApiResponse.ok(null);
    }

    @Audited(action = "SYS_USER_OTP_RESET", targetType = "app_user")
    @PostMapping("/{userId}/otp/reset")
    public ApiResponse<Void> resetOtp(@AuthenticationPrincipal KintexPrincipal principal,
                                      @PathVariable String userId) {
        guard.requireAdmin(principal);
        service.resetOtp(userId);
        return ApiResponse.ok(null);
    }
}
