import { Body, Controller, Delete, Get, HttpCode, Param, Post, Req } from '@nestjs/common';
import {
  createApiTokenInputSchema,
  type ApiTokenCreatedView,
  type ApiTokenView,
  type CreateApiTokenInput,
} from '@dorfteich/shared';

import { AuthedRequest } from '../auth/auth.guard';
import { ZodValidationPipe } from '../common/zod-validation.pipe';
import { AuthenticatedOnly } from '../permissions/permission.decorators';
import { ApiTokensService } from './api-tokens.service';

/**
 * Personal-access-token lifecycle for the settings UI (issue #104) —
 * session-authenticated and owner-scoped; the public API itself never
 * manages tokens (a leaked token must not be able to mint more).
 */
@Controller('users/me/api-tokens')
@AuthenticatedOnly()
export class ApiTokensController {
  constructor(private readonly tokens: ApiTokensService) {}

  @Get()
  list(@Req() request: AuthedRequest): Promise<ApiTokenView[]> {
    return this.tokens.list(request.user!);
  }

  @Post()
  create(
    @Body(new ZodValidationPipe(createApiTokenInputSchema)) input: CreateApiTokenInput,
    @Req() request: AuthedRequest,
  ): Promise<ApiTokenCreatedView> {
    return this.tokens.create(request.user!, input);
  }

  @Delete(':id')
  @HttpCode(204)
  async revoke(@Param('id') id: string, @Req() request: AuthedRequest): Promise<void> {
    await this.tokens.revoke(request.user!, id);
  }
}