import { CLAuthData, ClientAuth } from "@api/shared/decorators";
import { Public } from "@bish-nest/core/auth/decorator/public.decorator";
import { Body, Controller, Get, HttpCode, HttpStatus, Post, Query } from "@nestjs/common";
import { CLAuthService } from "./auth.service";
import {
  ParticipantSignInDto,
  ParticipantSignUpDto,
  RequestPasswordResetDto,
  ResendVerificationDto,
  SignInWithTokenDto,
  VerifyEmailDto,
} from "./dto";
import {
  SetPasswordDto,
  SetupPasswordDto,
  SetupPasswordResponseDto,
} from "./dto/password-setup.dto";

@Controller("api/client/auth")
export class CLAuthController {
  constructor(private authService: CLAuthService) {}

  /**
   * Sign in endpoint for participants
   * POST /api/client/auth/sign-in
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("sign-in")
  signIn(@Body() dto: ParticipantSignInDto) {
    return this.authService.signIn(dto);
  }

  /**
   * Sign up endpoint for participants
   * POST /api/client/auth/sign-up
   */
  @HttpCode(HttpStatus.CREATED)
  @Public()
  @Post("sign-up")
  signUp(@Body() dto: ParticipantSignUpDto) {
    return this.authService.signUp(dto);
  }

  /**
   * Sign in with token endpoint for participants
   * POST /api/client/auth/sign-in-with-token
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("sign-in-with-token")
  signInWithToken(@Body() dto: SignInWithTokenDto) {
    return this.authService.signInWithToken(dto.accessToken);
  }

  /**
   * Setup password endpoint for new account setup
   * POST /api/client/auth/setup-password
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("setup-password")
  async setupPassword(@Body() dto: SetupPasswordDto): Promise<SetupPasswordResponseDto> {
    return this.authService.setupPassword(dto);
  }

  /**
   * Validate password setup token
   * GET /api/client/auth/validate-setup-token?token=...
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Get("validate-setup-token")
  async validateSetupToken(@Query("token") token: string): Promise<{ valid: boolean; message?: string }> {
    return this.authService.validateSetupToken(token);
  }

  /**
   * Set initial password for logged-in participant with no password yet (invited / missing-password flow).
   * POST /api/client/auth/set-password
   */
  @HttpCode(HttpStatus.OK)
  @Post("set-password")
  async setPassword(
    @Body() dto: SetPasswordDto,
    @ClientAuth() auth: CLAuthData,
  ): Promise<{ success: boolean; message: string }> {
    return this.authService.setPasswordForLoggedInUser(auth.participantId, dto.password);
  }

  /**
   * Request password reset - sends password setup link via email
   * POST /api/client/auth/request-password-reset
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("request-password-reset")
  async requestPasswordReset(
    @Body() dto: RequestPasswordResetDto,
  ): Promise<{ success: boolean; message: string }> {
    return this.authService.requestPasswordReset(dto);
  }

  /**
   * Verify email address using verification token
   * POST /api/client/auth/verify-email
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("verify-email")
  async verifyEmail(@Body() dto: VerifyEmailDto): Promise<{ success: boolean; message: string }> {
    return this.authService.verifyEmail(dto.token);
  }

  /**
   * Resend email verification token (public; unverified users have no stable auth context)
   * POST /api/client/auth/resend-verification
   */
  @HttpCode(HttpStatus.OK)
  @Public()
  @Post("resend-verification")
  async resendVerification(
    @Body() body: ResendVerificationDto,
  ): Promise<{ success: boolean; message: string }> {
    return this.authService.resendEmailVerification(body.email);
  }
}