import { Body, Controller, Get, Param, Post } from '@nestjs/common';
import { LedgerService } from './ledger.service';
import { PostGoldRepaymentDto } from './dto/post-gold-repayment.dto';
import { PostRialRepaymentDto } from './dto/post-rial-repayment.dto';
import { RequirePermission } from '../auth/guards';

/**
 * Ledger operations — admin only.
 *
 * These were `@Public()` until the security hotfix. That was faithful to the
 * reference, where the whole admin route file is unauthenticated (the
 * `auth:api` group wrapper is commented out at henza_server/routes/admin.php:12
 * and :272), but it contradicted decision D1 in docs/parity/DECISIONS.md, which
 * confirms the target keeps its stricter auth. Four of these five routes WRITE
 * to the ledger, so an anonymous caller could reconcile a balance or post and
 * confirm a repayment.
 *
 * Rids follow the legacy vocabulary: reading a balance is a wallet read,
 * repayments are financial documents, and confirming an entry is the existing
 * document-confirm permission.
 */
@Controller('accounting')
export class AccountingController {
  constructor(private readonly ledger: LedgerService) {}

  @Get('customers/:customerId/balance')
  @RequirePermission('wallet.list')
  getBalance(@Param('customerId') customerId: string) {
    return this.ledger.getBalance(customerId);
  }

  @Post('customers/:customerId/reconcile')
  @RequirePermission('wallet.charge')
  reconcile(@Param('customerId') customerId: string) {
    return this.ledger.reconcileBalance(customerId);
  }

  @Post('repayments/gold')
  @RequirePermission('document.create')
  postGoldRepayment(@Body() dto: PostGoldRepaymentDto) {
    return this.ledger.postGoldRepayment(dto);
  }

  @Post('repayments/rial')
  @RequirePermission('document.create')
  postRialRepayment(@Body() dto: PostRialRepaymentDto) {
    return this.ledger.postRialRepayment(dto);
  }

  @Post('entries/:entryId/confirm')
  @RequirePermission('document.list.confirm')
  confirmEntry(@Param('entryId') entryId: string) {
    return this.ledger.confirmEntry(entryId);
  }
}