/**
 * TASK-0131 — SSO provider ADMIN endpoints (org-owner gated now; TASK-0133
 * swaps to the shared `requireOrgAdmin` guard — the route surface is stable):
 *
 *   GET    /api/v1/orgs/:orgId/sso        — provider + masked secrets flags
 *   POST   /api/v1/orgs/:orgId/sso        — create (one per org)
 *   PATCH  /api/v1/orgs/:orgId/sso        — update (+ cert/secret rotation)
 *   DELETE /api/v1/orgs/:orgId/sso        — remove provider + secrets
 *   PATCH  /api/v1/orgs/:orgId/sso/enforce— enforce toggle (mirror-writes policy)
 *   POST   /api/v1/orgs/:orgId/sso/test   — test connection (metadata / JWKS)
 *
 * These live UNDER the `api/v1` prefix (org sub-resource), so they are in the
 * OpenAPI contract surface (TASK-0127 generator + `liveRoutes()` both see
 * them).
 */
import { Body, Controller, Delete, Get, Inject, Param, Patch, Post, Req } from "@nestjs/common";
import type { Request } from "express";
import { ZodValidate } from "../../common/pipes/zod-validation.pipe.js";
import { SsoAdminService } from "./sso-admin.service.js";
import {
  SsoProviderAdminInputSchema,
  SsoProviderUpdateSchema,
  SsoEnforceSchema,
  type SsoProviderAdminInput
} from "./schemas.js";

@Controller("orgs/:orgId/sso")
export class SsoAdminController {
  constructor(@Inject(SsoAdminService) private readonly sso: SsoAdminService) {}

  @Get()
  get(@Param("orgId") orgId: string, @Req() req: Request) {
    return this.sso.get(orgId, req);
  }

  @Post()
  create(
    @Param("orgId") orgId: string,
    @Body(ZodValidate(SsoProviderAdminInputSchema)) body: SsoProviderAdminInput,
    @Req() req: Request
  ) {
    return this.sso.create(orgId, body, req);
  }

  @Patch()
  update(
    @Param("orgId") orgId: string,
    @Body(ZodValidate(SsoProviderUpdateSchema)) body: Parameters<SsoAdminService["update"]>[1],
    @Req() req: Request
  ) {
    return this.sso.update(orgId, body, req);
  }

  @Delete()
  remove(@Param("orgId") orgId: string, @Req() req: Request) {
    return this.sso.remove(orgId, req);
  }

  @Patch("enforce")
  enforce(
    @Param("orgId") orgId: string,
    @Body(ZodValidate(SsoEnforceSchema)) body: { enforce: boolean },
    @Req() req: Request
  ) {
    return this.sso.setEnforce(orgId, body, req);
  }

  @Post("test")
  test(@Param("orgId") orgId: string, @Req() req: Request) {
    return this.sso.test(orgId, req);
  }
}