import { Body, Controller, Get, Post, UseGuards } from "@nestjs/common";
import { Throttle } from "@nestjs/throttler";
import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from "@nestjs/swagger";
import { ApiErrorResponse } from "../common/swagger/api-error.schema";
import { AdminAuthService } from "./admin-auth.service";
import { AdminUserCtx } from "./admin-user.decorator";
import { AdminUserGuard } from "./admin-user.guard";
import { AdminUserPublicDto, AuthResponseDto } from "./dto/auth-response.dto";
import { LoginDto } from "./dto/login.dto";
import { RefreshDto } from "./dto/refresh.dto";

@ApiTags("Admin · Auth")
@Controller("admin/auth")
export class AdminAuthController {
  constructor(private readonly service: AdminAuthService) {}

  @Post("login")
  // 10 intentos por minuto para frustrar fuerza bruta sin trabar a un humano legítimo.
  @Throttle({ default: { limit: 10, ttl: 60_000 } })
  @ApiOperation({ operationId: "adminAuthLogin", summary: "Login de usuario admin" })
  @ApiResponse({ status: 200, type: AuthResponseDto })
  @ApiResponse({ status: 401, description: "Credenciales inválidas.", type: ApiErrorResponse })
  login(@Body() dto: LoginDto) {
    return this.service.login(dto.email, dto.password);
  }

  @Post("refresh")
  @Throttle({ default: { limit: 30, ttl: 60_000 } })
  @ApiOperation({ operationId: "adminAuthRefresh", summary: "Renovar access token" })
  @ApiResponse({ status: 200, type: AuthResponseDto })
  @ApiResponse({ status: 401, description: "Refresh inválido.", type: ApiErrorResponse })
  refresh(@Body() dto: RefreshDto) {
    return this.service.refresh(dto.refreshToken);
  }

  @Get("me")
  @ApiBearerAuth("adminUserAuth")
  @UseGuards(AdminUserGuard)
  @ApiOperation({ operationId: "adminAuthMe", summary: "Usuario actualmente autenticado" })
  @ApiResponse({ status: 200, type: AdminUserPublicDto })
  me(@AdminUserCtx() user: { id: string }) {
    return this.service.getMe(user.id);
  }
}