import { Body, Controller, Get, HttpCode, Post, Query } from '@nestjs/common';
import { SalesAgentService } from './sales-agent.service';
import { CurrentAdmin } from '../auth/guards';
import type { AuthenticatedAdmin } from '../auth/jwt.strategy';

/**
 * The sales expert's own routes in the customer apps.
 *
 * Deliberately NOT part of CustomersModule: CustomersController is @Public() at
 * the CLASS level, which would defeat a route-level guard here. This controller
 * carries no @Public() at all, so the globally-registered JwtAuthGuard applies to
 * every route below and the caller is always a real, token-authenticated
 * AdminUser.
 *
 * Note these are NOT @RequirePermission()-gated. The rids in UserType 86
 * («کارشناس فروش») describe what an agent may do in the ADMIN PANEL; these
 * routes are the customer-app surface and are scoped by identity instead — the
 * service checks `role === 'SALES_EXPERT'` and every query is filtered to the
 * caller's own id, never to an id taken from the request.
 */
@Controller('sales-agent')
export class SalesAgentController {
  constructor(private readonly salesAgent: SalesAgentService) {}

  @Get('me')
  me(@CurrentAdmin() admin: AuthenticatedAdmin) {
    return this.salesAgent.me(admin);
  }

  @Get('my-customers')
  myCustomers(@CurrentAdmin() admin: AuthenticatedAdmin, @Query('search') search?: string) {
    return this.salesAgent.myCustomers(admin, search);
  }

  @Post('verify-acting-as')
  @HttpCode(200)
  verifyActingAs(
    @CurrentAdmin() admin: AuthenticatedAdmin,
    @Body() body: { customerId: string },
  ) {
    return this.salesAgent.verifyActingAs(admin, body.customerId);
  }
}