import { Body, Controller, Get, Param, ParseUUIDPipe, Patch, Post } from '@nestjs/common';
import type { AuthenticatedUser } from '../../common/auth/authenticated-user';
import { CurrentUser } from '../../common/auth/current-user.decorator';
import { Roles } from '../../common/auth/roles.decorator';
import { CreateUserDto } from './dto/create-user.dto';
import { UpdateModuleAccessDto } from './dto/update-module-access.dto';
import { UpdateUserDto } from './dto/update-user.dto';
import { UsersService } from './users.service';

/**
 * Administrator-only user management. There is deliberately no delete route:
 * `app_state` cascades on user deletion, so removing an account would silently
 * destroy every trade, portfolio and watchlist it owns. Deactivate instead —
 * it revokes access immediately (AuthSessionsService.resolve filters on
 * is_active) while keeping the data recoverable.
 */
@Roles('ADMIN')
@Controller('users')
export class UsersController {
  constructor(private readonly users: UsersService) {}

  @Get()
  list() {
    return this.users.list();
  }

  @Post()
  create(@Body() input: CreateUserDto) {
    return this.users.create(input);
  }

  @Patch(':id')
  update(
    @Param('id', ParseUUIDPipe) id: string,
    @Body() input: UpdateUserDto,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.users.update(id, input, actor);
  }

  /** Grant or revoke terminals for one account. */
  @Patch(':id/modules')
  setModuleAccess(
    @Param('id', ParseUUIDPipe) id: string,
    @Body() input: UpdateModuleAccessDto,
    @CurrentUser() actor: AuthenticatedUser,
  ) {
    return this.users.setModuleAccess(id, input.modules, actor);
  }
}