import { service as defaultService } from "../modules/dashboard/service.js";
import { makeDashboardApi } from "../modules/dashboard/api.js";
import { fail, sessionRoute } from "../common/http.js";

const requireUser = (fn) => sessionRoute("dashboard", fn);

// The browser gets the bare payload; the { message, data } envelope is for the
// API-key router.
const send = (res, { status, data }) =>
  status === 200
    ? res.json(data)
    : fail(res, status, status === 404 ? "not_found" : "bad_request", data?.error);

export function dashboardHandlers({ service = defaultService } = {}) {
  const api = makeDashboardApi(service);
  const route = (fn) => requireUser(async (req, res) => send(res, await fn(req)));
  return {
    summary: route((req) => api.summary(req.query, req.user.id)),
    transactions: route((req) => api.transactions(req.query, req.user.id)),
    series: route((req) => api.series(req.query, req.user.id)),
    verify: route((req) => api.verify(req.query, req.user.id)),
    // View JSON exposes the raw payload (possibly private); the can_view_json
    // capability comes from the user's role in the DB (see getUser).
    event: requireUser(async (req, res) => {
      if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
      send(res, await api.event({ eventUuid: req.params.eventUuid }, req.user.id));
    }),
    agreement: route((req) => api.agreement({ agreementUuid: req.params.agreementUuid }, req.user.id)),
    details: requireUser(async (req, res) => {
      if (!req.user.canViewJson) return fail(res, 403, "forbidden", "not permitted to view JSON");
      send(res, await api.details({ eventUuid: req.params.eventUuid }, req.user.id));
    })
  };
}