import { Router } from 'express';
import atemschutzController from '../controllers/atemschutz.controller';
import { authenticate } from '../middleware/auth.middleware';
import { requirePermission } from '../middleware/rbac.middleware';

const router = Router();

// ── Read-only ────────────────────────────────────────────────────────────────

router.get('/',           authenticate, requirePermission('atemschutz:view'), atemschutzController.list.bind(atemschutzController));
router.get('/stats',      authenticate, requirePermission('atemschutz:view'), atemschutzController.getStats.bind(atemschutzController));
router.get('/expiring',   authenticate, requirePermission('atemschutz:view'), atemschutzController.getExpiring.bind(atemschutzController));
router.get('/my-status',     authenticate, atemschutzController.getMyStatus.bind(atemschutzController));
router.get('/user/:userId',  authenticate, requirePermission('atemschutz:view'), atemschutzController.getByUserId.bind(atemschutzController));
router.get('/:id',           authenticate, requirePermission('atemschutz:view'), atemschutzController.getOne.bind(atemschutzController));

// ── Write — gruppenfuehrer+ ─────────────────────────────────────────────────

router.post('/',     authenticate, requirePermission('atemschutz:create'), atemschutzController.create.bind(atemschutzController));
router.patch('/:id', authenticate, requirePermission('atemschutz:create'), atemschutzController.update.bind(atemschutzController));

// ── Delete — kommandant+ ────────────────────────────────────────────────────

router.delete('/:id', authenticate, requirePermission('atemschutz:delete'), atemschutzController.delete.bind(atemschutzController));

export default router;
