package router

import (
	"affiliate_dash/internal/handler"
	"affiliate_dash/internal/middleware"
	"affiliate_dash/internal/model"
	"affiliate_dash/internal/pkg/jwt"

	"github.com/gin-contrib/cors"
	"github.com/gin-gonic/gin"
)

type Handlers struct {
	Auth          *handler.AuthHandler
	Skin          *handler.SkinHandler
	Order         *handler.OrderHandler
	User          *handler.UserHandler
	Open          *handler.OpenHandler
	JWT           *jwt.Manager
	OpenAPIKey    string
	OpenAPISecret string
	OpenSignSkew  int64
}

func Setup(h *Handlers) *gin.Engine {
	r := gin.Default()

	r.Use(cors.New(cors.Config{
		AllowOrigins:     []string{"http://localhost:5173", "http://127.0.0.1:5173"},
		AllowMethods:     []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization", "X-Api-Key", "X-Timestamp", "X-Nonce", "X-Sign"},
		ExposeHeaders:    []string{"Content-Length"},
		AllowCredentials: true,
	}))

	r.GET("/health", func(c *gin.Context) {
		c.JSON(200, gin.H{"status": "ok"})
	})

	api := r.Group("/api")
	{
		api.POST("/auth/login", h.Auth.Login)
		api.POST("/auth/register", h.Auth.Register)

		// 皮肤源头开放接口（ApiKey + HMAC 签名）
		open := api.Group("/open/v1")
		open.Use(middleware.OpenAuth(middleware.OpenAuthConfig{
			APIKey:      h.OpenAPIKey,
			APISecret:   h.OpenAPISecret,
			SkewSeconds: h.OpenSignSkew,
		}))
		{
			open.GET("/orders/:order_no", h.Open.QueryOrder)
			open.POST("/orders/ship-notify", h.Open.ShipNotify)
		}

		auth := api.Group("")
		auth.Use(middleware.Auth(h.JWT))
		{
			auth.GET("/auth/profile", h.Auth.Profile)
			auth.GET("/dashboard", h.Order.Dashboard)

			// 皮肤
			auth.GET("/skins", h.Skin.List)
			auth.GET("/skins/:id", h.Skin.Get)
			auth.POST("/skins", middleware.RequireRole(model.RoleAdmin), h.Skin.Create)
			auth.PUT("/skins/:id", middleware.RequireRole(model.RoleAdmin), h.Skin.Update)
			auth.DELETE("/skins/:id", middleware.RequireRole(model.RoleAdmin), h.Skin.Delete)

			// 订单
			auth.GET("/orders", h.Order.List)
			auth.POST("/orders", h.Order.Create)
			auth.PATCH("/orders/:id/status", middleware.RequireRole(model.RoleAdmin), h.Order.UpdateStatus)

			// 用户 / 分销商 / 发货记录（仅管理员）
			admin := auth.Group("")
			admin.Use(middleware.RequireRole(model.RoleAdmin))
			{
				admin.GET("/users", h.User.List)
				admin.POST("/users", h.User.Create)
				admin.PATCH("/users/:id/status", h.User.UpdateStatus)
				admin.GET("/ship-logs", h.Order.ListShipLogs)
			}
		}
	}

	return r
}