app/src/routes/admin/roles.ts

import { FastifyInstance } from "fastify";
import prisma from "../../config/database";
import { requirePermission } from "../../middleware/auth";
import { logAudit } from "../../services/audit";
import { success, error, parseId } from "../../utils/response";
import { parseBody } from "../../schemas/common";
import { CreateRoleSchema, UpdateRoleSchema } from "../../schemas/roles.schema";

export default async function rolesRoutes(
  fastify: FastifyInstance,
): Promise<void> {
  // GET /api/admin/roles
  fastify.get(
    "/",
    { preHandler: requirePermission("settings.roles") },
    async (request, reply) => {
      const [roles, userCounts] = await Promise.all([
        prisma.roles.findMany({
          include: {
            role_permissions: {
              include: { permissions: true },
            },
          },
          orderBy: { id: "asc" },
        }),
        prisma.users.groupBy({
          by: ["role_id"],
          _count: { id: true },
        }),
      ]);

      const countMap = new Map(
        userCounts.map((u) => [u.role_id, Number(u._count.id)]),
      );

      const data = roles.map((r) => ({
        ...r,
        permissions: r.role_permissions.map((rp) => rp.permissions),
        user_count: countMap.get(r.id) || 0,
      }));

      return success(reply, data);
    },
  );

  // GET /api/admin/roles/permissions
  fastify.get(
    "/permissions",
    { preHandler: requirePermission("settings.roles") },
    async (_request, reply) => {
      const permissions = await prisma.permissions.findMany({
        orderBy: [{ module: "asc" }, { id: "asc" }],
      });
      return success(reply, permissions);
    },
  );

  // POST /api/admin/roles
  fastify.post(
    "/",
    { preHandler: requirePermission("settings.roles") },
    async (request, reply) => {
      const parsed = parseBody(CreateRoleSchema, request.body);
      if ("error" in parsed) return error(reply, parsed.error, 400);
      const body = parsed.data;

      const role = await prisma.roles.create({
        data: {
          name: String(body.name),
          display_name: String(body.display_name),
          description: body.description ? String(body.description) : null,
        },
      });

      if (Array.isArray(body.permission_ids)) {
        await prisma.$transaction(
          (body.permission_ids as number[]).map((pid) =>
            prisma.role_permissions.create({
              data: {
                role_id: role.id,
                permission_id: pid,
              },
            }),
          ),
        );
      }

      await logAudit({
        request,
        authData: request.authData,
        action: "create",
        entityType: "role",
        entityId: role.id,
        description: `Vytvořena role ${role.name}`,
      });

      return success(reply, { id: role.id }, 201, "Role byla vytvořena");
    },
  );

  // PUT /api/admin/roles/:id
  fastify.put<{ Params: { id: string } }>(
    "/:id",
    { preHandler: requirePermission("settings.roles") },
    async (request, reply) => {
      const id = parseId(request.params.id, reply);
      if (id === null) return;
      const parsed = parseBody(UpdateRoleSchema, request.body);
      if ("error" in parsed) return error(reply, parsed.error, 400);
      const body = parsed.data;

      const existing = await prisma.roles.findUnique({ where: { id } });
      if (!existing) return error(reply, "Role nenalezena", 404);

      await prisma.roles.update({
        where: { id },
        data: {
          display_name: body.display_name
            ? String(body.display_name)
            : undefined,
          description:
            body.description !== undefined
              ? String(body.description)
              : undefined,
        },
      });

      if (Array.isArray(body.permission_ids)) {
        await prisma.$transaction([
          prisma.role_permissions.deleteMany({ where: { role_id: id } }),
          prisma.role_permissions.createMany({
            data: (body.permission_ids as number[]).map((pid) => ({
              role_id: id,
              permission_id: pid,
            })),
          }),
        ]);
      }

      await logAudit({
        request,
        authData: request.authData,
        action: "update",
        entityType: "role",
        entityId: id,
        description: `Upravena role ${existing.name}`,
      });

      return success(reply, { id }, 200, "Role byla aktualizována");
    },
  );

  // DELETE /api/admin/roles/:id
  fastify.delete<{ Params: { id: string } }>(
    "/:id",
    { preHandler: requirePermission("settings.roles") },
    async (request, reply) => {
      const id = parseId(request.params.id, reply);
      if (id === null) return;

      const existing = await prisma.roles.findUnique({ where: { id } });
      if (!existing) return error(reply, "Role nenalezena", 404);

      if (existing.name === "admin") {
        return error(reply, "Nelze smazat roli admin", 400);
      }

      await prisma.roles.delete({ where: { id } });

      await logAudit({
        request,
        authData: request.authData,
        action: "delete",
        entityType: "role",
        entityId: id,
        description: `Smazána role ${existing.name}`,
      });

      return success(reply, { id }, 200, "Role byla smazána");
    },
  );
}