import { Body, Controller, Delete, Get, HttpCode, Param, Post, Req } from '@nestjs/common';
import {
  CreateGrantInput,
  GrantView,
  createGrantInputSchema,
  grantOfInput,
} from '@dorfteich/shared';

import { AuthedRequest } from '../auth/auth.guard';
import { ZodValidationPipe } from '../common/zod-validation.pipe';
import { RequiresPondRole } from '../permissions/permission.decorators';
import { GrantsService } from './grants.service';

/**
 * Grant management (issue #52): a pond's grants are its Pond Admins'
 * business — members and their roles (permissions.md). The member-management
 * UI on top of this arrives with #54.
 */
@Controller('ponds/:pondId/grants')
export class GrantsController {
  constructor(private readonly grants: GrantsService) {}

  @Get()
  @RequiresPondRole('pond_admin', { idParam: 'pondId' })
  async list(@Param('pondId') pondId: string): Promise<GrantView[]> {
    return this.grants.listGrants(pondId);
  }

  @Post()
  @RequiresPondRole('pond_admin', { idParam: 'pondId' })
  async create(
    @Param('pondId') pondId: string,
    @Body(new ZodValidationPipe(createGrantInputSchema)) input: CreateGrantInput,
    @Req() request: AuthedRequest,
  ): Promise<GrantView> {
    return this.grants.createGrant(request.user!, pondId, grantOfInput(input));
  }

  @Delete(':grantId')
  @HttpCode(204)
  @RequiresPondRole('pond_admin', { idParam: 'pondId' })
  async remove(
    @Param('pondId') pondId: string,
    @Param('grantId') grantId: string,
    @Req() request: AuthedRequest,
  ): Promise<void> {
    await this.grants.deleteGrant(request.user!, pondId, grantId);
  }
}