package de.votian.services.controller;

import de.votian.services.dto.UserSessionDto;
import de.votian.services.entity.AppRight;
import de.votian.services.repository.AppRightRepository;
import de.votian.services.security.AccessControlService;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.List;

@RestController
@RequestMapping("/api/rights")
public class RightsController {

    private final AppRightRepository appRightRepository;
    private final AccessControlService accessControlService;

    public RightsController(AppRightRepository appRightRepository,
                            AccessControlService accessControlService) {
        this.appRightRepository = appRightRepository;
        this.accessControlService = accessControlService;
    }

    @GetMapping
    public ResponseEntity<List<AppRight>> findAll(Authentication authentication) {
        UserSessionDto user = accessControlService.sessionUser(authentication);
        if (!accessControlService.canManageEmployeeMatrixRights(user)) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }
        return ResponseEntity.ok(appRightRepository.findAllByOrderByIdAsc());
    }
}
