'use strict';
// routes/mailLogs.js — read-only Mail Log viewer API. Access: full Admin and
// System Admin roles always; any other user must be granted the 'mail_log'
// module. Mirrors routes/audit.js exactly.
const express = require('express');
const router  = express.Router();
const { verifyToken } = require('../middleware/auth');
const store = require('../services/mailLogStore');

async function requireMailLogView(req, res, next) {
  const u = req.user || {};
  if (u.role === 'admin' || u.role === 'system_admin') return next();
  try {
    const full = await require('../services/hanaUsers').findById(u.id);
    const mods = Array.isArray(full && full.modules) ? full.modules : [];
    if (mods.includes('mail_log')) return next();
  } catch (_e) {}
  return res.status(403).json({ success: false, message: 'You do not have access to the Mail Log.' });
}

router.get('/', verifyToken, requireMailLogView, async (req, res) => {
  try {
    const { data, total } = await store.list(req.query);
    res.json({ success: true, data, total });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

module.exports = router;