const express = require('express');
const router = express.Router();
const { authenticateToken } = require('../middleware/auth');
const { requireAdmin, canViewAssets, canModifyAssets } = require('../middleware/roleCheck');
const ctrl = require('../controllers/warehouse.controller');

// Summary / Dashboard
router.get('/summary',          authenticateToken, canViewAssets,   ctrl.getSummary);
router.get('/violations',       authenticateToken, canViewAssets,   ctrl.getStockViolations);

// Locations
router.get('/locations',        authenticateToken, canViewAssets,   ctrl.getLocations);
router.post('/locations',       authenticateToken, requireAdmin,     ctrl.createLocation);
router.put('/locations/:id',    authenticateToken, requireAdmin,     ctrl.updateLocation);
router.delete('/locations/:id', authenticateToken, requireAdmin,     ctrl.deleteLocation);

// Movements
router.get('/movements',        authenticateToken, canViewAssets,   ctrl.getMovements);
router.post('/movements',       authenticateToken, canModifyAssets, ctrl.createMovement);

// Stock thresholds
router.get('/thresholds',              authenticateToken, canViewAssets, ctrl.getThresholds);
router.post('/thresholds',             authenticateToken, requireAdmin,  ctrl.upsertThreshold);
router.delete('/thresholds/:category', authenticateToken, requireAdmin,  ctrl.deleteThreshold);

// Purchase orders
router.get('/orders',           authenticateToken, canViewAssets,   ctrl.getPurchaseOrders);
router.post('/orders',          authenticateToken, canModifyAssets, ctrl.createPurchaseOrder);
router.put('/orders/:id',       authenticateToken, canModifyAssets, ctrl.updatePurchaseOrder);
router.delete('/orders/:id',    authenticateToken, requireAdmin,    ctrl.deletePurchaseOrder);

// QR Code (kein Auth nötig für Scan-Link, aber wir sichern es trotzdem)
router.get('/qr/:id',           authenticateToken, canViewAssets,   ctrl.getQrCode);

module.exports = router;
