// src/app/api/admin/roles/route.ts
import { createRolesHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { GET, POST } = createRolesHandler({
  checkPermission,
  adminPermission: 'roles:manage',
})

// src/lib/rbac-definitions.ts
import type { PermissionDefinition, RoleDefinition, CategoryDefinition } from '@mostajs/rbac'

// Categories de permissions
export const CATEGORIES: CategoryDefinition[] = [
  { name: 'users',    label: 'Utilisateurs',  description: 'Gestion des utilisateurs',  icon: 'Users',   order: 1, system: true },
  { name: 'products', label: 'Produits',       description: 'Gestion des produits',      icon: 'Package', order: 2, system: false },
  { name: 'orders',   label: 'Commandes',      description: 'Gestion des commandes',     icon: 'Receipt', order: 3, system: false },
  { name: 'reports',  label: 'Rapports',       description: 'Consultation des rapports', icon: 'BarChart', order: 4, system: false },
]

// Permissions
export const PERMISSIONS_DEFS: PermissionDefinition[] = [
  { code: 'users:view',    name: 'users:view',    description: 'Voir les utilisateurs',     category: 'users' },
  { code: 'users:create',  name: 'users:create',  description: 'Creer un utilisateur',      category: 'users' },
  { code: 'users:edit',    name: 'users:edit',    description: 'Modifier un utilisateur',   category: 'users' },
  { code: 'users:delete',  name: 'users:delete',  description: 'Supprimer un utilisateur',  category: 'users' },
  { code: 'products:view', name: 'products:view', description: 'Voir les produits',         category: 'products' },
  { code: 'products:edit', name: 'products:edit', description: 'Modifier les produits',     category: 'products' },
  { code: 'orders:view',   name: 'orders:view',   description: 'Voir les commandes',        category: 'orders' },
  { code: 'orders:manage', name: 'orders:manage', description: 'Gerer les commandes',       category: 'orders' },
  { code: 'reports:view',  name: 'reports:view',  description: 'Consulter les rapports',    category: 'reports' },
]

// Roles par defaut
export const DEFAULT_ROLES: Record<string, RoleDefinition> = {
  admin: {
    name: 'admin',
    description: 'Administrateur — acces complet',
    system: true,
    permissions: PERMISSIONS_DEFS.map(p => p.code),
  },
  manager: {
    name: 'manager',
    description: 'Manager — gestion produits et commandes',
    system: false,
    permissions: ['users:view', 'products:view', 'products:edit', 'orders:view', 'orders:manage', 'reports:view'],
  },
  viewer: {
    name: 'viewer',
    description: 'Consultation seule',
    system: false,
    permissions: ['products:view', 'orders:view', 'reports:view'],
  },
}

// Constantes de permissions pour les guards
export const PERMISSIONS = Object.fromEntries(
  PERMISSIONS_DEFS.map(p => [p.code.replace(':', '_').toUpperCase(), p.code])
) as Record<string, string>

// src/app/api/admin/roles/route.ts
import { createRolesHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'
import { logAudit, getAuditUser } from '@mostajs/audit/lib/audit'  // optionnel

export const { GET, POST } = createRolesHandler({
  checkPermission,
  adminPermission: 'roles:manage',
  logAudit,        // optionnel
  getAuditUser,    // optionnel
})

// src/app/api/admin/roles/[id]/route.ts
import { createRolesIdHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { GET, PUT, DELETE } = createRolesIdHandler({
  checkPermission,
  adminPermission: 'roles:manage',
})

// src/app/api/admin/permissions/route.ts
import { createPermissionsHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'
import { PERMISSIONS_DEFS } from '@/lib/rbac-definitions'

export const { GET, POST } = createPermissionsHandler({
  checkPermission,
  adminPermission: 'permissions:manage',
  permissionDefinitions: PERMISSIONS_DEFS,
})

// src/app/api/admin/permissions/[id]/route.ts
import { createPermissionsIdHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { PUT, DELETE } = createPermissionsIdHandler({
  checkPermission,
  adminPermission: 'permissions:manage',
})

// src/app/api/admin/permissions/matrix/route.ts
import { createMatrixHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { GET, POST } = createMatrixHandler({
  checkPermission,
  adminPermission: 'permissions:manage',
})

// src/app/api/admin/categories/route.ts
import { createCategoriesHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'
import { CATEGORIES } from '@/lib/rbac-definitions'

export const { GET, POST } = createCategoriesHandler({
  checkPermission,
  adminPermission: 'categories:manage',
  categoryDefinitions: CATEGORIES,
})

// src/app/api/admin/categories/[id]/route.ts
import { createCategoriesIdHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { PUT, DELETE } = createCategoriesIdHandler({
  checkPermission,
  adminPermission: 'categories:manage',
})

// src/app/api/admin/permissions/seed/route.ts
import { createSeedHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'
import { PERMISSIONS_DEFS, DEFAULT_ROLES, CATEGORIES } from '@/lib/rbac-definitions'

export const { POST } = createSeedHandler({
  checkPermission,
  adminPermission: 'admin',
  permissionDefinitions: PERMISSIONS_DEFS,
  defaultRoles: DEFAULT_ROLES,
  categoryDefinitions: CATEGORIES,
})

// src/app/api/users/route.ts
import { createUsersHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { GET, POST } = createUsersHandler({
  checkPermission,
  adminPermission: 'users:manage',
  knownRoles: ['admin', 'manager', 'viewer'],
})

// src/app/api/users/[id]/route.ts
import { createUsersIdHandler } from '@mostajs/rbac/server'
import { checkPermission } from '@/lib/auth'

export const { GET, PUT, DELETE } = createUsersIdHandler({
  checkPermission,
  adminPermission: 'users:manage',
})

interface Config {
  checkPermission: (perm: string) => Promise<{
    error: NextResponse | null  // null = autorise
    session: any                // session utilisateur
  }>
  adminPermission: string       // permission requise (ex: 'roles:manage')
  logAudit?: (entry) => void    // optionnel, journalisation
  getAuditUser?: (session) => {} // optionnel, extraction user
}

import { createUsersApi, createRolesApi, createPermissionsApi, createMatrixApi, createCategoriesApi } from '@mostajs/rbac'

const usersApi = createUsersApi('/api')
const users = await usersApi.fetchUsers()
await usersApi.createUser({ email: 'a@b.com', password: '123456', firstName: 'A', lastName: 'B', role: 'viewer' })

const rolesApi = createRolesApi('/api')
const roles = await rolesApi.fetchRoles()

const matrixApi = createMatrixApi('/api')
const matrix = await matrixApi.fetchMatrix()
await matrixApi.seedRbac()

interface PermissionDefinition {
  code: string       // Identifiant unique (ex: 'users:view')
  name: string       // Nom en DB (generalement = code)
  description: string
  category: string   // Nom de la categorie parente
}

interface RoleDefinition {
  name: string
  description: string
  system: boolean         // true = protege (ne peut pas etre supprime)
  permissions: string[]   // Liste des codes permission
}

interface CategoryDefinition {
  name: string        // Identifiant unique
  label: string       // Label affiche
  description: string
  icon: string        // Nom d'icone Lucide
  order: number       // Ordre d'affichage
  system: boolean     // true = ne peut pas etre supprime
}