// rbac-admin-api ist der Aufrufpunkt fuer RBAC-07: startet den bereits
// fertigen RBAC-05-Handler (internal/rbac) als eigenstaendigen HTTP-Dienst,
// hinter derselben Session-Auth wie IAM-16 (account-api) — GLEICHER
// JWT-Secret, damit eine bei account-api ausgestellte Session hier auch
// gueltig ist. REINES WIRING — keine Aenderung an internal/rbac/.
package main

import (
	"context"
	"log"
	"net/http"
	"os"

	"github.com/jackc/pgx/v5/pgxpool"

	"gitea.perlbach24.de/scripte/nexarch/internal/auth"
	"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
)

func requireEnv(name string) string {
	v := os.Getenv(name)
	if v == "" {
		log.Fatalf("%s muss gesetzt sein", name)
	}
	return v
}

func main() {
	dsn := requireEnv("NEXARCH_RBACADMIN_TENANT_DSN")
	// MUSS identisch mit NEXARCH_ACCOUNT_JWT_SECRET (IAM-16) sein, sonst
	// verwirft dieser Dienst gueltige account-api-Sessions.
	jwtSecret := requireEnv("NEXARCH_RBACADMIN_JWT_SECRET")
	addr := os.Getenv("NEXARCH_RBACADMIN_API_LISTEN_ADDR")
	if addr == "" {
		addr = "127.0.0.1:8100"
	}

	ctx := context.Background()
	pool, err := pgxpool.New(ctx, dsn)
	if err != nil {
		log.Fatalf("datenbankverbindung: %v", err)
	}
	defer pool.Close()

	tokenIssuer := auth.NewTokenIssuer(jwtSecret)
	roles := rbac.NewStore(pool)
	groups := rbac.NewGroupStore(pool)
	handler := rbac.NewHandler(roles, groups)

	mux := http.NewServeMux()
	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })

	mux.HandleFunc("GET /rbac/roles", auth.RequireAuth(tokenIssuer, handler.ListRoles))
	mux.HandleFunc("POST /rbac/users/role", auth.RequireAuth(tokenIssuer, handler.AssignRole))
	mux.HandleFunc("GET /rbac/users/{id}/history", auth.RequireAuth(tokenIssuer, handler.RoleHistory))
	mux.HandleFunc("GET /rbac/groups", auth.RequireAuth(tokenIssuer, handler.ListGroups))
	mux.HandleFunc("POST /rbac/groups", auth.RequireAuth(tokenIssuer, handler.CreateGroup))
	mux.HandleFunc("POST /rbac/groups/role", auth.RequireAuth(tokenIssuer, handler.SetGroupRole))
	mux.HandleFunc("POST /rbac/groups/members", auth.RequireAuth(tokenIssuer, handler.AddGroupMember))
	mux.HandleFunc("POST /rbac/groups/members/remove", auth.RequireAuth(tokenIssuer, handler.RemoveGroupMember))

	log.Printf("rbac-admin-api: listening on %s", addr)
	if err := http.ListenAndServe(addr, mux); err != nil {
		log.Fatalf("http server: %v", err)
	}
}