import {
  Body,
  Controller,
  Delete,
  Get,
  Param,
  Post,
  UseGuards,
} from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import type { LoginUserInfo } from '../../auth/dto/login.dto';
import { RequireModule, RequirePermission } from '../../auth/decorators';
import { ModuleGuard } from '../../auth/guards/module.guard';
import { PermissionGuard } from '../../auth/guards/permission.guard';
import { GetUser } from '../../auth/get-user.decorator';
import { CrearApiKeyDto } from './api-publica.dto';
import { ApiKeysService } from './api-keys.service';

@ApiTags('Cartera Inteligente — API Keys')
@ApiBearerAuth()
@UseGuards(AuthGuard('jwt'), ModuleGuard, PermissionGuard)
@RequireModule('COBRANZAS')
@Controller({ path: 'cartera/api-keys', version: '1' })
export class ApiKeysController {
  constructor(private readonly service: ApiKeysService) {}

  @Get()
  @RequirePermission('COBRANZAS', 'COB_CART_VER')
  @ApiOperation({ summary: 'Listar API keys del tenant' })
  listar(@GetUser() user: LoginUserInfo) {
    return this.service.listar(user.empresa_id);
  }

  @Post()
  @RequirePermission('COBRANZAS', 'COB_CART_CONFIGURAR')
  @ApiOperation({
    summary: 'Crear nueva API key (devuelve plaintext UNA sola vez)',
    description: 'La key plaintext no se vuelve a poder ver. Copiala apenas se genera.',
  })
  crear(@Body() dto: CrearApiKeyDto, @GetUser() user: LoginUserInfo) {
    return this.service.crear(user.empresa_id, user.id, {
      nombre: dto.nombre,
      scopes: dto.scopes as any,
      expira_en_dias: dto.expira_en_dias,
    });
  }

  @Delete(':id')
  @RequirePermission('COBRANZAS', 'COB_CART_CONFIGURAR')
  @ApiOperation({ summary: 'Revocar API key (la deja inservible inmediatamente)' })
  revocar(@Param('id') id: string, @GetUser() user: LoginUserInfo) {
    return this.service.revocar(user.empresa_id, id);
  }

  @Get('audit')
  @RequirePermission('COBRANZAS', 'COB_CART_VER')
  @ApiOperation({ summary: 'Auditoría de llamadas a la API pública' })
  audit(@GetUser() user: LoginUserInfo) {
    return this.service.auditRecientes(user.empresa_id, 100);
  }
}