import { Body, Controller, Get, Param, Patch, Post, Query, UseGuards } from "@nestjs/common";
import { ApiBearerAuth, ApiTags } from "@nestjs/swagger";
import { CompaniesService } from "./companies.service.js";
import { CreateCompanyDto } from "./dto/create-company.dto.js";
import { UpdateCompanyDto } from "./dto/update-company.dto.js";
import { JwtAuthGuard } from "../auth/jwt-auth.guard.js";
import { PermissionGuard } from "../auth/permission.guard.js";
import { RequirePermission } from "../auth/decorators/require-permission.decorator.js";
import { CurrentUser } from "../auth/decorators/current-user.decorator.js";
import type { EdenAuthenticatedUser } from "../auth/jwt-auth.guard.js";

/**
 * Read is open to any authenticated user (not gated by a resource
 * permission) — company data isn't sensitive and is needed to render
 * contracts/documents from screens any seller/backoffice user can reach,
 * mirroring the legacy (eden.md §1, §6). Write requires companies:manage.
 */
@ApiTags("companies")
@ApiBearerAuth()
@UseGuards(JwtAuthGuard, PermissionGuard)
@Controller("v1/companies")
export class CompaniesController {
  constructor(private readonly companies: CompaniesService) {}

  @Get()
  list(@Query("includeInactive") includeInactive?: string) {
    return this.companies.list(includeInactive === "true");
  }

  @Get(":id")
  get(@Param("id") id: string) {
    return this.companies.get(id);
  }

  @Post()
  @RequirePermission("companies", "manage")
  create(@Body() dto: CreateCompanyDto, @CurrentUser() user: EdenAuthenticatedUser) {
    return this.companies.create(dto, user.id);
  }

  @Patch(":id")
  @RequirePermission("companies", "manage")
  update(
    @Param("id") id: string,
    @Body() dto: UpdateCompanyDto,
    @CurrentUser() user: EdenAuthenticatedUser,
  ) {
    return this.companies.update(id, dto, user.id);
  }
}