const express = require('express');
const router  = express.Router();
const ctrl    = require('../controllers/entra.controller');
const { authenticateToken } = require('../middleware/auth');
const { requireAdmin }      = require('../middleware/roleCheck');
const { asyncHandler }      = require('../middleware/errorHandler');

router.use(authenticateToken);
router.use(requireAdmin);

router.get('/users',                                    asyncHandler(ctrl.getUsers));
router.get('/users/:id/groups',                         asyncHandler(ctrl.getUserGroups));
router.get('/groups',                                   asyncHandler(ctrl.getGroups));
router.get('/groups/:id/members',                       asyncHandler(ctrl.getGroupMembers));
router.post('/groups/:id/members',                      asyncHandler(ctrl.addGroupMember));
router.delete('/groups/:id/members/:userId',            asyncHandler(ctrl.removeGroupMember));
router.get('/roles',                                    asyncHandler(ctrl.getRoles));
// Benutzerverwaltung — pro User
router.get('/users/:azureId/profile',                   asyncHandler(ctrl.getUserProfile));
router.get('/users/:azureId/licenses',                  asyncHandler(ctrl.getUserLicenses));
router.get('/users/:azureId/signin-log',                asyncHandler(ctrl.getUserSignInLog));
router.get('/users/:azureId/signin-risk',               asyncHandler(ctrl.getUserSignInRisk));
router.post('/users/:azureId/invalidate-sessions',      asyncHandler(ctrl.invalidateSessions));
router.get('/conditional-access-policies',              asyncHandler(ctrl.getCAP));

module.exports = router;
