using Backend.Security;

namespace Backend.Endpoints;

public static class AdminEndpoints
{
    public static IEndpointRouteBuilder MapAdminEndpoints(this IEndpointRouteBuilder app)
    {
        var group = app.MapGroup("/api/admin")
            .AddEndpointFilter<AdminSessionFilter>();

        group.MapAdminSiteSettingsEndpoints();

        var managerGroup = group.MapGroup(string.Empty)
            .AddEndpointFilter(RequireAdminWorkspaceRole);

        managerGroup.MapAdminDashboardEndpoints();
        managerGroup.MapAdminSeasonManagementEndpoints();
        managerGroup.MapAdminModerationEndpoints();

        return app;
    }

    private static async ValueTask<object?> RequireAdminWorkspaceRole(
        EndpointFilterInvocationContext context,
        EndpointFilterDelegate next)
    {
        var session = AdminEndpointConventions.CurrentSession(context.HttpContext);
        if (!AdminRoles.CanManageAdminWorkspace(session.Role))
        {
            return Results.Json(new { message = "This admin area requires an admin or owner role." }, statusCode: StatusCodes.Status403Forbidden);
        }

        return await next(context);
    }
}