using System.ComponentModel.DataAnnotations;
using Asp.Versioning;
using Baya.Application.Features.PartnerCenters.Commands.CreatePartnerCenter;
using Baya.Application.Features.PartnerCenters.Commands.SetPartnerCenterActive;
using Baya.Application.Features.PartnerCenters.Commands.SponsorNurse;
using Baya.Application.Features.PartnerCenters.Commands.UpdatePartnerCenter;
using Baya.Application.Features.PartnerCenters.Commands.VerifyPartnerCenter;
using Baya.Application.Features.PartnerCenters.Queries.GetPartnerCenterById;
using Baya.Application.Features.PartnerCenters.Queries.ListPartnerCenters;
using Baya.Application.Models.Common;
using Baya.Application.Models.PartnerCenters;
using Baya.Infrastructure.Identity.Identity.PermissionManager;
using Baya.WebFramework.Attributes;
using Baya.WebFramework.BaseController;
using Mediator;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Baya.Web.Api.Controllers.V1;

/// <summary>
/// Admin partner-center console (admin/super_admin). Creates/updates/verifies licensed centers and sponsors
/// nurses. The settlement IBAN is encrypted at rest and returned <b>masked</b> (last 4). Internal-only, audited.
/// </summary>
[ApiVersion("1")]
[ApiController]
[Route("api/v{version:apiVersion}/admin/partner-centers")]
[Authorize(ConstantPolicies.DynamicPermission)]
[Display(Description = "Admin partner-center management (licensed sponsor / merchant-of-record)")]
public sealed class AdminPartnerCentersController(ISender sender) : BaseController
{
    [HttpPost]
    [ProducesOkApiResponseType<PartnerCenterDetailDto>]
    public async Task<IActionResult> Create(CreatePartnerCenterCommand command, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(command, cancellationToken));

    [HttpPatch("{id}")]
    [ProducesOkApiResponseType<PartnerCenterDetailDto>]
    public async Task<IActionResult> Update(long id, UpdatePartnerCenterCommand command, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(command with { Id = id }, cancellationToken));

    [HttpPost("{id}/verify")]
    [ProducesOkApiResponseType<PartnerCenterDetailDto>]
    public async Task<IActionResult> Verify(long id, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(new VerifyPartnerCenterCommand(id), cancellationToken));

    [HttpPost("{id}/sponsor-nurse")]
    [ProducesOkApiResponseType]
    public async Task<IActionResult> SponsorNurse(long id, SponsorNurseCommand command, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(command with { CenterId = id }, cancellationToken));

    // Activate/suspend toggle (distinct from verify, which records licensing approval) — REQ-032.
    [HttpPost("{id}/set-active")]
    [ProducesOkApiResponseType<PartnerCenterDetailDto>]
    public async Task<IActionResult> SetActive(long id, SetPartnerCenterActiveCommand command, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(command with { Id = id }, cancellationToken));

    [HttpGet]
    [ProducesOkApiResponseType<PagedResult<PartnerCenterListItemDto>>]
    public async Task<IActionResult> List([FromQuery] ListPartnerCentersQuery query, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(query, cancellationToken));

    [HttpGet("{id}")]
    [ProducesOkApiResponseType<PartnerCenterDetailDto>]
    public async Task<IActionResult> GetById(long id, CancellationToken cancellationToken)
        => OperationResult(await sender.Send(new GetPartnerCenterByIdQuery(id), cancellationToken));
}
