import { Router } from 'express';
import incidentController from '../controllers/incident.controller';
import { authenticate } from '../middleware/auth.middleware';
import { requirePermission } from '../middleware/rbac.middleware';

const router = Router();

// All incident routes require authentication
router.use(authenticate);

/**
 * @route   GET /api/incidents
 * @desc    List incidents with pagination and filters
 * @access  mitglied+
 * @query   dateFrom, dateTo, einsatzArt, status, limit, offset
 */
router.get(
  '/',
  requirePermission('einsaetze:view'),
  incidentController.listIncidents.bind(incidentController)
);

/**
 * @route   GET /api/incidents/stats
 * @desc    Aggregated statistics (monthly + by type) for a given year
 * @access  mitglied+
 * @query   year (optional, defaults to current year)
 *
 * NOTE: This route MUST be defined before /:id to prevent 'stats' being
 * captured as an id parameter.
 */
router.get(
  '/stats',
  requirePermission('einsaetze:view'),
  incidentController.getStats.bind(incidentController)
);

/**
 * @route   POST /api/incidents/refresh-stats
 * @desc    Refresh einsatz_statistik materialized view (admin utility)
 * @access  admin only
 */
router.post(
  '/refresh-stats',
  requirePermission('einsaetze:create'),
  incidentController.refreshStats.bind(incidentController)
);

/**
 * @route   GET /api/incidents/:id
 * @desc    Get single incident with full detail (personnel, vehicles, timeline)
 * @access  mitglied+ (bericht_text redacted for roles below kommandant)
 */
router.get(
  '/:id',
  requirePermission('einsaetze:view'),
  incidentController.getIncident.bind(incidentController)
);

/**
 * @route   POST /api/incidents
 * @desc    Create a new incident
 * @access  gruppenfuehrer+
 */
router.post(
  '/',
  requirePermission('einsaetze:create'),
  incidentController.createIncident.bind(incidentController)
);

/**
 * @route   PATCH /api/incidents/:id
 * @desc    Update an existing incident (partial update)
 * @access  gruppenfuehrer+
 */
router.patch(
  '/:id',
  requirePermission('einsaetze:create'),
  incidentController.updateIncident.bind(incidentController)
);

/**
 * @route   DELETE /api/incidents/:id
 * @desc    Soft-delete (archive) an incident
 * @access  kommandant+
 */
router.delete(
  '/:id',
  requirePermission('einsaetze:delete'),
  incidentController.deleteIncident.bind(incidentController)
);

/**
 * @route   POST /api/incidents/:id/personnel
 * @desc    Assign a member to an incident with a function (Funktion)
 * @access  gruppenfuehrer+
 * @body    { user_id: UUID, funktion?: string, alarm_time?: ISO8601, ankunft_time?: ISO8601 }
 */
router.post(
  '/:id/personnel',
  requirePermission('einsaetze:manage_personnel'),
  incidentController.assignPersonnel.bind(incidentController)
);

/**
 * @route   DELETE /api/incidents/:id/personnel/:userId
 * @desc    Remove a member from an incident
 * @access  gruppenfuehrer+
 */
router.delete(
  '/:id/personnel/:userId',
  requirePermission('einsaetze:manage_personnel'),
  incidentController.removePersonnel.bind(incidentController)
);

/**
 * @route   POST /api/incidents/:id/vehicles
 * @desc    Assign a vehicle to an incident
 * @access  gruppenfuehrer+
 * @body    { fahrzeug_id: UUID, ausrueck_time?: ISO8601, einrueck_time?: ISO8601 }
 */
router.post(
  '/:id/vehicles',
  requirePermission('einsaetze:manage_personnel'),
  incidentController.assignVehicle.bind(incidentController)
);

/**
 * @route   DELETE /api/incidents/:id/vehicles/:fahrzeugId
 * @desc    Remove a vehicle from an incident
 * @access  gruppenfuehrer+
 */
router.delete(
  '/:id/vehicles/:fahrzeugId',
  requirePermission('einsaetze:manage_personnel'),
  incidentController.removeVehicle.bind(incidentController)
);

export default router;
