const express = require('express');
const router = express.Router();
const userController = require('../controllers/user.controller');
const { verifyToken, checkRole, roles } = require('../middleware/auth.middleware');

// Get all users (only super_admin)
router.get('/', 
  verifyToken, 
  checkRole([roles.SUPER_ADMIN]), 
  userController.getAllUsers
);

// Get user by id
router.get('/:id', 
  verifyToken, 
  checkRole([roles.SUPER_ADMIN, roles.ADMIN]), 
  userController.getUserById
);

// Create new user (only super_admin)
router.post('/', 
  verifyToken, 
  checkRole([roles.SUPER_ADMIN]), 
  userController.createUser
);

// Update user (super_admin can update any user, admin can update only their profile)
router.put('/:id', 
  verifyToken, 
  userController.updateUser
);

// Delete user (only super_admin)
router.delete('/:id', 
  verifyToken, 
  checkRole([roles.SUPER_ADMIN]), 
  userController.deleteUser
);

module.exports = router;
