import { Router } from 'express';
import * as customerController from '../controllers/customer.controller.js';
import * as customerReferralController from '../controllers/customerReferral.controller.js';
import * as stressfreiEmailController from '../controllers/stressfreiEmail.controller.js';
import { authenticate, requirePermission, requireCustomerAccess } from '../middleware/auth.js';

const router = Router();

// Customers
router.get('/', authenticate, requirePermission('customers:read'), customerController.getCustomers);
router.post('/', authenticate, requirePermission('customers:create'), customerController.createCustomer);
router.get('/:id', authenticate, requireCustomerAccess, customerController.getCustomer);
router.put('/:id', authenticate, requirePermission('customers:update'), customerController.updateCustomer);
router.delete('/:id', authenticate, requirePermission('customers:delete'), customerController.deleteCustomer);

// Addresses
router.get('/:customerId/addresses', authenticate, requireCustomerAccess, customerController.getAddresses);
router.post('/:customerId/addresses', authenticate, requirePermission('customers:update'), customerController.createAddress);

// Bank Cards
router.get('/:customerId/bank-cards', authenticate, requireCustomerAccess, customerController.getBankCards);
router.post('/:customerId/bank-cards', authenticate, requirePermission('customers:update'), customerController.createBankCard);

// Identity Documents
router.get('/:customerId/documents', authenticate, requireCustomerAccess, customerController.getDocuments);
router.post('/:customerId/documents', authenticate, requirePermission('customers:update'), customerController.createDocument);

// Meters
router.get('/:customerId/meters', authenticate, requireCustomerAccess, customerController.getMeters);
router.post('/:customerId/meters', authenticate, requirePermission('customers:update'), customerController.createMeter);

// Stressfrei-Wechseln E-Mail-Adressen
router.get('/:customerId/stressfrei-emails', authenticate, requireCustomerAccess, stressfreiEmailController.getEmailsByCustomer);
router.post('/:customerId/stressfrei-emails', authenticate, requirePermission('customers:update'), stressfreiEmailController.createEmail);

// Portal Settings
router.get('/:customerId/portal', authenticate, requirePermission('customers:update'), customerController.getPortalSettings);
router.put('/:customerId/portal', authenticate, requirePermission('customers:update'), customerController.updatePortalSettings);
router.post('/:customerId/portal/password', authenticate, requirePermission('customers:update'), customerController.setPortalPassword);
router.get('/:customerId/portal/password', authenticate, requirePermission('customers:update'), customerController.getPortalPassword);
router.post('/:customerId/portal/password/generate', authenticate, requirePermission('customers:update'), customerController.generatePortalPassword);
router.post('/:customerId/portal/send-credentials', authenticate, requirePermission('customers:update'), customerController.sendPortalCredentials);

// Salutation-Präferenz pro User (Du/Sie) – 2026-07-04. Nutzt
// requireCustomerAccess damit auch Portal-User (falls je nötig) nicht
// automatisch scheitern; der Endpoint speichert userId aus dem Token.
router.get('/:customerId/salutation-preference', authenticate, requireCustomerAccess, customerController.getSalutationPreference);
router.put('/:customerId/salutation-preference', authenticate, requireCustomerAccess, customerController.setSalutationPreference);
router.delete('/:customerId/salutation-preference', authenticate, requireCustomerAccess, customerController.clearSalutationPreference);

// Representatives (Vertreter)
router.get('/:customerId/representatives', authenticate, requirePermission('customers:read'), customerController.getRepresentatives);
router.post('/:customerId/representatives', authenticate, requirePermission('customers:update'), customerController.addRepresentative);
router.delete('/:customerId/representatives/:representativeId', authenticate, requirePermission('customers:update'), customerController.removeRepresentative);
router.get('/:customerId/representatives/search', authenticate, requirePermission('customers:read'), customerController.searchForRepresentative);

// Werbung ("Geworben / angeworben") – nur Mitarbeiter/Admins (Controller
// blockt Portal zusätzlich explizit). /search VOR der Liste ist unkritisch,
// da unterschiedliche Pfade, aber der Klarheit halber gruppiert.
router.get('/:customerId/referrals/search', authenticate, requirePermission('customers:read'), customerReferralController.searchCustomers);
router.get('/:customerId/referrals', authenticate, requirePermission('customers:read'), customerReferralController.getReferrals);
router.post('/:customerId/referrals', authenticate, requirePermission('customers:update'), customerReferralController.createReferral);
router.put('/:customerId/referrals/:referralId', authenticate, requirePermission('customers:update'), customerReferralController.updateReferral);
router.delete('/:customerId/referrals/:referralId', authenticate, requirePermission('customers:update'), customerReferralController.deleteReferral);

export default router;
