/***********************************************************************************************************************************************************************
 * File Name: admin.routes.js
 * Type of Program: Router
 * Description: Protected routes accessible by admin only — full control.
 *
 * Route Map:
 *   Users:
 *   GET    /api/admin/users                        → all users
 *   GET    /api/admin/users/:id                    → single user with groups
 *   PUT    /api/admin/users/:id                    → update user (acc_type, status, profile)
 *   DELETE /api/admin/users/:id                    → hard delete user
 *   GET    /api/admin/users/:id/sessions           → view all sessions
 *   DELETE /api/admin/users/:id/sessions/:sid      → force-terminate a session
 *
 *   Groups:
 *   GET    /api/admin/groups                       → list groups
 *   POST   /api/admin/groups                       → create group
 *   DELETE /api/admin/groups/:gid                  → delete group
 *   POST   /api/admin/users/:id/groups/:gid        → add user to group
 *   DELETE /api/admin/users/:id/groups/:gid        → remove user from group
 *
 * Guards: authenticate → requireAdmin()
 *
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 ***********************************************************************************************************************************************************************/
const express   = require('express');
const router    = express.Router();

const usersCtrl = require('../../controllers/admin/users.controller');
const { authenticate } = require('../../middleware/auth.middleware');
const { requireAdmin } = require('../../middleware/rbac.middleware');
const { adminLimiter, sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');

// Apply adminLimiter to ALL admin routes
router.use(authenticate, requireAdmin(), adminLimiter);

// ── User management ────────────────────────────────────────────────────────────
router.get('/users',                              usersCtrl.getUsers);
router.get('/users/:id',                          usersCtrl.getUser);
router.put('/users/:id',       sensitiveOpsLimiter, usersCtrl.updateUser);
router.delete('/users/:id',    sensitiveOpsLimiter, usersCtrl.deactivateUser);  // soft delete
router.post('/users/:id/restore', sensitiveOpsLimiter, usersCtrl.restoreUser);  // restore

// ── Session management ─────────────────────────────────────────────────────────
router.get('/users/:id/sessions',                         usersCtrl.getUserSessions);
router.delete('/users/:id/sessions/:sid', sensitiveOpsLimiter, usersCtrl.terminateSession);

// ─── Groups Management ───────────────────────────────────────────────────────────────
router.get('/groups',                   usersCtrl.getGroups);
router.get('/groups/:gid',              usersCtrl.getGroup);
router.post('/groups',                  sensitiveOpsLimiter, usersCtrl.createGroup);
router.put('/groups/:gid',              sensitiveOpsLimiter, usersCtrl.updateGroup);
router.patch('/groups/:gid/deactivate', sensitiveOpsLimiter, usersCtrl.deactivateGroup);
router.patch('/groups/:gid/restore',    sensitiveOpsLimiter, usersCtrl.restoreGroup);

// ─── Group membership ──────────────────────────────────────────────────────────
router.get('/groups/:gid/users',        usersCtrl.getUsersInGroup);
router.get('/groups/:gid/users/add',    usersCtrl.getUsersNotInGroup);
router.post('/groups/:gid/users',       sensitiveOpsLimiter, usersCtrl.addUserToGroup);
router.delete('/groups/:gid/users',     sensitiveOpsLimiter, usersCtrl.removeUserFromGroup);

module.exports = router;