/***********************************************************************************************************************************************************************
 * File Name: staff.routes.js
 * Type of Program: Router
 * Description: Protected routes accessible by staff and admin only.
 *              Staff can view non-admin users and toggle their status.
 *              Staff cannot view or modify admins.
 *
 * Route Map:
 *   GET  /api/staff/users                    → paginated user list (non-admins)
 *   GET  /api/staff/users/:id                → view a specific non-admin user
 *   PUT  /api/staff/users/:id/status         → activate or deactivate a user
 *   GET  /api/staff/users/:id/sessions       → view user's sessions
 *
 * Guards: authenticate → requireStaff()
 *
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 ***********************************************************************************************************************************************************************/
const express   = require('express');
const router    = express.Router();

const usersCtrl = require('../../controllers/staff/users.controller');
const { authenticate } = require('../../middleware/auth.middleware');
const { requireStaff } = require('../../middleware/rbac.middleware');

router.use(authenticate, requireStaff());

router.get('/users/',                       usersCtrl.getUsers);
router.get('/users/:id',                    usersCtrl.getUser);
router.put('/users/:id/status',             usersCtrl.setUserStatus);
router.get('/users/:id/sessions',           usersCtrl.getUserSessions);

module.exports = router;