/**
 * TASK-0132 — SCIM ADMIN endpoints (org-owner gated now; TASK-0133 swaps to
 * the shared `requireOrgAdmin` guard — the route surface is stable):
 *
 *   GET    /api/v1/orgs/:orgId/scim        — config (masked, no raw token)
 *   POST   /api/v1/orgs/:orgId/scim        — enable (generates scim_… token, reveal-once)
 *   PATCH  /api/v1/orgs/:orgId/scim        — update / rotate / disable
 *   POST   /api/v1/orgs/:orgId/scim/test   — test-connection (browser token)
 *
 * Under the `api/v1` prefix → part of the OpenAPI contract surface
 * (regenerate the spec after controller changes).
 */
import { Body, Controller, Get, Inject, Param, Patch, Post, Req } from "@nestjs/common";
import type { Request } from "express";
import { ZodValidate } from "../../common/pipes/zod-validation.pipe.js";
import { ScimAdminService } from "./scim-admin.service.js";
import { ScimAdminUpdateSchema, ScimEnableSchema, ScimTestSchema, type ScimAdminUpdate } from "./schemas.js";

@Controller("orgs/:orgId/scim")
export class ScimAdminController {
  constructor(@Inject(ScimAdminService) private readonly scim: ScimAdminService) {}

  @Get()
  get(@Param("orgId") orgId: string, @Req() req: Request) {
    return this.scim.get(orgId, req);
  }

  @Post()
  enable(@Param("orgId") orgId: string, @Body(ZodValidate(ScimEnableSchema)) body: Parameters<ScimAdminService["enable"]>[1], @Req() req: Request) {
    return this.scim.enable(orgId, body, req);
  }

  @Patch()
  update(@Param("orgId") orgId: string, @Body(ZodValidate(ScimAdminUpdateSchema)) body: ScimAdminUpdate, @Req() req: Request) {
    return this.scim.update(orgId, body, req);
  }

  @Post("test")
  test(@Param("orgId") orgId: string, @Body(ZodValidate(ScimTestSchema)) body: { token: string }, @Req() req: Request) {
    return this.scim.test(orgId, body.token, req);
  }
}