import { Controller, ForbiddenException, Get, UseGuards } from "@nestjs/common";
import { getPrismaClient } from "@b2bcall/database";
import { isPlatformUser, type AccessTokenClaims } from "@b2bcall/auth";
import { JwtAuthGuard } from "../common/guards/jwt-auth.guard";
import { PermissionGuard } from "../common/guards/permission.guard";
import { RequirePermission } from "../common/decorators/require-permission.decorator";
import { CurrentUser } from "../common/decorators/current-user.decorator";

/**
 * "Sistema > Permissões" (agente.md secao 142-145, 168) — só leitura por
 * enquanto: RBAC é system-defined (roles/permissions vêm do seed,
 * `packages/auth/src/seed.ts`), sem UI de criar role customizada ainda.
 * `roles`/`permissions` não têm RLS (catálogo global do sistema).
 */
@UseGuards(JwtAuthGuard, PermissionGuard)
@Controller("platform/roles")
export class PlatformRolesController {
  @RequirePermission("roles.manage")
  @Get()
  async list(@CurrentUser() user: AccessTokenClaims) {
    if (!(await isPlatformUser(user.sub))) {
      throw new ForbiddenException("So' um usuario com role de plataforma pode ver o catalogo de roles/permissoes");
    }
    const prisma = getPrismaClient();

    const [roles, permissions] = await Promise.all([
      prisma.role.findMany({
        include: { rolePermissions: { include: { permission: true } } },
        orderBy: { name: "asc" },
      }),
      prisma.permission.findMany({ orderBy: { key: "asc" } }),
    ]);

    return {
      permissions,
      roles: roles.map((r) => ({
        id: r.id,
        key: r.key,
        name: r.name,
        scope: r.scope,
        isSystem: r.isSystem,
        permissionKeys: r.rolePermissions.map((rp) => rp.permission.key),
      })),
    };
  }
}