package com.zioinfo.kintex.auth.integrity;

import com.zioinfo.kintex.auth.EventAccessGuard;
import com.zioinfo.kintex.auth.KintexPrincipal;
import com.zioinfo.kintex.auth.integrity.dto.AppIntegrityRequest;
import com.zioinfo.kintex.auth.integrity.dto.AppIntegrityResponse;
import com.zioinfo.kintex.common.ApiResponse;
import jakarta.validation.Valid;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * B2 — 앱 무결성 검증 엔드포인트(골격). 인증 필요(SecurityConfig anyRequest().authenticated()).
 * {@code POST /api/auth/app-integrity/verify} — 모바일이 Play Integrity/App Attest 토큰을 첨부.
 * 온프레미스 외부 API 금지로 실검증은 스텁(mode=STUB) — {@link AppIntegrityService} 참조.
 */
@RestController
@RequestMapping("/api/auth/app-integrity")
public class AppIntegrityController {

    private final AppIntegrityService service;
    private final EventAccessGuard guard;

    public AppIntegrityController(AppIntegrityService service, EventAccessGuard guard) {
        this.service = service;
        this.guard = guard;
    }

    @PostMapping("/verify")
    public ApiResponse<AppIntegrityResponse> verify(@AuthenticationPrincipal KintexPrincipal principal,
                                                    @Valid @RequestBody AppIntegrityRequest req) {
        guard.require(principal);
        return ApiResponse.ok(service.verify(principal.userId(), req));
    }
}
