package de.votian.services.controller;

import de.votian.services.dto.TrackingDashboardDto;
import de.votian.services.dto.UserSessionDto;
import de.votian.services.security.AccessControlService;
import de.votian.services.service.TrackingService;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.time.LocalDate;
import java.util.List;

@RestController
@RequestMapping("/api/tracking")
public class TrackingController {

    private final TrackingService trackingService;
    private final AccessControlService accessControlService;

    public TrackingController(TrackingService trackingService,
                              AccessControlService accessControlService) {
        this.trackingService = trackingService;
        this.accessControlService = accessControlService;
    }

    @GetMapping("/dashboard")
    public ResponseEntity<TrackingDashboardDto> getDashboard(@RequestParam Long hqId,
                                                             @RequestParam(required = false)
                                                             @DateTimeFormat(iso = DateTimeFormat.ISO.DATE)
                                                             LocalDate day,
                                                             @RequestParam(required = false) Boolean includeCompleted,
                                                             @RequestParam(required = false) Long customerId,
                                                             Authentication authentication) {
        UserSessionDto user = accessControlService.sessionUser(authentication);
        if (!accessControlService.canViewTracking(user) || !accessControlService.canAccessHeadquarters(user, hqId)) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }

        Long effectiveCustomerId = customerId;
        List<Long> accessibleCostCenterIds = null;
        if (accessControlService.isCustomerUser(user)) {
            if (user.getCustomerId() == null) {
                return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
            }
            if (customerId != null && !customerId.equals(user.getCustomerId())) {
                return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
            }
            effectiveCustomerId = user.getCustomerId();
            accessibleCostCenterIds = user.getAccessibleCostCenterIds();
        }

        return ResponseEntity.ok(trackingService.getDashboard(
                hqId,
                day,
                Boolean.TRUE.equals(includeCompleted),
                effectiveCustomerId,
                accessibleCostCenterIds
        ));
    }
}
