/**
 * EXAMPLE: Permission-Based Route Protection
 * 
 * This file demonstrates how to use permission middleware in routes.
 * Copy the pattern to your actual route files.
 */

const express = require('express');
const router = express.Router();
const { authenticateToken } = require('../middlewares/auth');
const { requirePermission, requireOperation } = require('../middlewares/permission');

// Example controller (replace with your actual controller)
const exampleController = {
  create: (req, res) => res.json({ success: true, message: 'Created' }),
  getAll: (req, res) => res.json({ success: true, data: [] }),
  getById: (req, res) => res.json({ success: true, data: {} }),
  update: (req, res) => res.json({ success: true, message: 'Updated' }),
  approve: (req, res) => res.json({ success: true, message: 'Approved' }),
  delete: (req, res) => res.json({ success: true, message: 'Deleted' })
};

// ============================================
// EXAMPLE 1: Purchase Order Routes
// ============================================

// Create Purchase Order - requires CREATE permission
router.post(
  '/purchase-orders',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_CREATE'),
  exampleController.create
);

// Get All Purchase Orders - requires VIEW permission
router.get(
  '/purchase-orders',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_VIEW'),
  exampleController.getAll
);

// Get Purchase Order by ID - requires VIEW permission
router.get(
  '/purchase-orders/:id',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_VIEW'),
  exampleController.getById
);

// Update Purchase Order - requires EDIT permission
router.put(
  '/purchase-orders/:id',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_EDIT'),
  exampleController.update
);

// Approve Purchase Order - requires APPROVE permission
router.put(
  '/purchase-orders/:id/approve',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_APPROVE'),
  exampleController.approve
);

// Delete Purchase Order - requires DELETE permission (if exists)
router.delete(
  '/purchase-orders/:id',
  authenticateToken,
  requirePermission('PURCHASE_PURCHASE_ORDER_DELETE'),
  exampleController.delete
);

// ============================================
// EXAMPLE 2: Using requireOperation (Shorthand)
// ============================================

// Create Sales Order using shorthand
router.post(
  '/sales-orders',
  authenticateToken,
  requireOperation('SALES', 'SALES_ORDER', 'CREATE'),
  exampleController.create
);

// Approve Sales Order using shorthand
router.put(
  '/sales-orders/:id/approve',
  authenticateToken,
  requireOperation('SALES', 'SALES_ORDER', 'APPROVE'),
  exampleController.approve
);

// ============================================
// EXAMPLE 3: Multiple Permissions (Any)
// ============================================

// View if user has VIEW or APPROVE permission
router.get(
  '/production-orders',
  authenticateToken,
  requirePermission(['PRODUCTION_PRODUCTION_ORDER_VIEW', 'PRODUCTION_PRODUCTION_ORDER_APPROVE']),
  exampleController.getAll
);

// ============================================
// EXAMPLE 4: Multiple Permissions (All Required)
// ============================================

// Approve requires both VIEW and APPROVE permissions
router.put(
  '/production-orders/:id/approve',
  authenticateToken,
  requirePermission(
    ['PRODUCTION_PRODUCTION_ORDER_VIEW', 'PRODUCTION_PRODUCTION_ORDER_APPROVE'],
    { requireAll: true }
  ),
  exampleController.approve
);

// ============================================
// EXAMPLE 5: Disable Audit Logging
// ============================================

// For high-frequency operations, disable audit logging
router.get(
  '/materials',
  authenticateToken,
  requirePermission('ENGINEERING_MATERIAL_VIEW', { logAudit: false }),
  exampleController.getAll
);

// ============================================
// EXAMPLE 6: Production Order Operations
// ============================================

// Start Production Order
router.post(
  '/production-orders/:id/start',
  authenticateToken,
  requirePermission('PRODUCTION_PRODUCTION_ORDER_START'),
  exampleController.approve
);

// Pause Production Order
router.post(
  '/production-orders/:id/pause',
  authenticateToken,
  requirePermission('PRODUCTION_PRODUCTION_ORDER_PAUSE'),
  exampleController.approve
);

// Resume Production Order
router.post(
  '/production-orders/:id/resume',
  authenticateToken,
  requirePermission('PRODUCTION_PRODUCTION_ORDER_RESUME'),
  exampleController.approve
);

// Close Production Order
router.post(
  '/production-orders/:id/close',
  authenticateToken,
  requirePermission('PRODUCTION_PRODUCTION_ORDER_CLOSE'),
  exampleController.approve
);

module.exports = router;

