'use strict';
// routes/woHeaderProfiles.js — Work Order print/PDF "Header Details" as a
// list of named profiles (Blood Bag / CAPD / Accessories / …), each mapped
// to a set of SAP Item Groups, instead of one flat global config. See
// services/woHeaderProfileStore.js for the full design note.
//
// List/read is open to any authenticated user — work-order-print.html (any
// user who can print a Work Order) needs to fetch this to resolve which
// profile applies. Managing profiles (create/edit/delete/set-default) is
// gated by the 'work_order:approved_mgr_qa' approval step — the same step
// that already represents "QA Manager" for Work Order approval in this app
// — rather than requiring full Admin access. Admins always bypass via
// hasStepPerm's own role check.
const express = require('express');
const router  = express.Router();
const { verifyToken, hasStepPerm } = require('../middleware/auth');

const store = () => require('../services/woHeaderProfileStore');

function requireQaManagerEdit(req, res, next) {
  if (hasStepPerm(req.user, 'work_order:approved_mgr_qa', 'edit')) return next();
  res.status(403).json({ success: false, message: 'You are not assigned "edit" on approval step: work_order:approved_mgr_qa' });
}

router.get('/', verifyToken, async (req, res) => {
  try {
    const data = await store().listProfiles();
    res.json({ success: true, data });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.get('/:id', verifyToken, async (req, res) => {
  try {
    const r = await store().findById(req.params.id);
    if (!r || r.isDeleted) return res.status(404).json({ success: false, message: 'Not found' });
    res.json({ success: true, data: r });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.post('/', verifyToken, requireQaManagerEdit, async (req, res) => {
  try {
    const b = req.body || {};
    if (!(b.name || '').trim()) return res.status(400).json({ success: false, message: 'Name is required' });
    const saved = await store().createProfile({
      name: b.name.trim(), itemGroups: Array.isArray(b.itemGroups) ? b.itemGroups.map(String) : [],
      companyName: b.companyName || '', companyAddress: b.companyAddress || '', formNo: b.formNo || '',
      effectiveDate: b.effectiveDate || '', reviewDate: b.reviewDate || '', logo: b.logo || '',
      createdBy: req.user.username, createdByName: req.user.name || req.user.username,
    });
    res.json({ success: true, data: saved });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.put('/:id', verifyToken, requireQaManagerEdit, async (req, res) => {
  try {
    const existing = await store().findById(req.params.id);
    if (!existing || existing.isDeleted) return res.status(404).json({ success: false, message: 'Not found' });
    const b = req.body || {};
    if (!(b.name || '').trim()) return res.status(400).json({ success: false, message: 'Name is required' });
    const updated = await store().updateProfile(req.params.id, {
      name: b.name.trim(), itemGroups: Array.isArray(b.itemGroups) ? b.itemGroups.map(String) : [],
      companyName: b.companyName || '', companyAddress: b.companyAddress || '', formNo: b.formNo || '',
      effectiveDate: b.effectiveDate || '', reviewDate: b.reviewDate || '', logo: b.logo || '',
    });
    res.json({ success: true, data: updated });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.post('/:id/set-default', verifyToken, requireQaManagerEdit, async (req, res) => {
  try {
    const existing = await store().findById(req.params.id);
    if (!existing || existing.isDeleted) return res.status(404).json({ success: false, message: 'Not found' });
    const updated = await store().setDefault(req.params.id);
    res.json({ success: true, data: updated });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.delete('/:id', verifyToken, requireQaManagerEdit, async (req, res) => {
  try {
    const existing = await store().findById(req.params.id);
    if (!existing) return res.status(404).json({ success: false, message: 'Not found' });
    await store().softDelete(req.params.id);
    res.json({ success: true });
  } catch (err) { res.status(400).json({ success: false, message: err.message }); }
});

module.exports = router;