package com.zioinfo.kintex.ticket.smart;

import com.zioinfo.kintex.common.ApiResponse;
import com.zioinfo.kintex.ticket.smart.SmartTicketDtos.ActivateRequest;
import com.zioinfo.kintex.ticket.smart.SmartTicketDtos.ActivateResultDto;
import com.zioinfo.kintex.ticket.smart.SmartTicketDtos.RotatingTokenDto;
import com.zioinfo.kintex.ticket.smart.SmartTicketDtos.VerifyRequest;
import com.zioinfo.kintex.ticket.smart.SmartTicketDtos.VerifyResultDto;
import jakarta.validation.Valid;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

/**
 * F-B1 스마트티켓(회전 QR) 공개 API — 전 경로 {@code /api/public/**} permitAll.
 * <p>보안: 응답에 secret·deviceId 원문 미포함. 검증은 실패도 200(valid=false)로 정보 노출 최소화.
 */
@RestController
@RequestMapping("/api/public/tickets/smart")
public class SmartTicketController {

    private final SmartTicketService service;

    public SmartTicketController(SmartTicketService service) {
        this.service = service;
    }

    /** POST /activate — 예매번호+연락처 본인확인 후 티켓을 기기에 바인딩. */
    @PostMapping("/activate")
    public ApiResponse<ActivateResultDto> activate(@Valid @RequestBody ActivateRequest req) {
        return ApiResponse.ok(service.activate(req.orderNo(), req.contact(), req.ticketCode(), req.deviceId()));
    }

    /** GET /token?ticketCode=&deviceId= — 바인딩 기기의 현재 회전 토큰(QR 페이로드). */
    @GetMapping("/token")
    public ApiResponse<RotatingTokenDto> token(@RequestParam String ticketCode,
                                               @RequestParam String deviceId) {
        return ApiResponse.ok(service.currentToken(ticketCode, deviceId));
    }

    /** POST /verify — 게이트 스캐너 QR 검증(회전 토큰 유효성). */
    @PostMapping("/verify")
    public ApiResponse<VerifyResultDto> verify(@Valid @RequestBody VerifyRequest req) {
        return ApiResponse.ok(service.verify(req.qrPayload()));
    }
}
