const express = require('express');
const router = express.Router();
const ctrl = require('../controllers/share.controller');
const { authenticateToken } = require('../middleware/auth');

const requireAdmin = (req, res, next) => {
    if (!['super_admin', 'admin'].includes(req.user?.role_name)) {
        return res.status(403).json({ error: 'Kein Zugriff' });
    }
    next();
};

// Public routes (kein Login nötig)
router.get('/public/:token', ctrl.getPublicShare);
router.post('/public/:token/access', ctrl.accessShare);
router.get('/public/:token/file', ctrl.downloadFile);

// Protected routes
router.use(authenticateToken);
router.post('/', ctrl.createShare);
router.get('/', requireAdmin, ctrl.getAllShares);
router.delete('/:id', requireAdmin, ctrl.deleteShare);

module.exports = router;
