// src/Webshop.Api/Controllers/Customer/CheckoutController.cs
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
using System.Threading.Tasks;
using Webshop.Application.Services.Customers.Interfaces;
using Webshop.Application.DTOs.Orders;
using System.Security.Claims;
using Microsoft.AspNetCore.Http;
using Webshop.Application;

namespace Webshop.Api.Controllers.Customer
{
    [ApiController]
    [Route("api/v1/customer/[controller]")]
    [Authorize(Roles = "Customer")]
    public class CheckoutController : ControllerBase
    {
        private readonly ICheckoutService _checkoutService;

        public CheckoutController(ICheckoutService checkoutService)
        {
            _checkoutService = checkoutService;
        }

        [HttpPost("create-order")]
        [ProducesResponseType(typeof(OrderDetailDto), StatusCodes.Status201Created)]
        [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
        [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
        [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status403Forbidden)]
        [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status409Conflict)]
        public async Task<IActionResult> CreateOrder([FromBody] CreateOrderDto orderDto)
        {
            if (!ModelState.IsValid)
            {
                return BadRequest(ModelState);
            }

            // UserId aus dem JWT-Token des eingeloggten Kunden extrahieren
            var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
            if (string.IsNullOrEmpty(userId))
            {
                return Unauthorized(new { Message = "Benutzer konnte nicht identifiziert werden." });
            }

            var result = await _checkoutService.CreateOrderAsync(orderDto, userId);

            return result.Type switch
            {
                ServiceResultType.Success => Created($"/api/v1/customer/orders/{result.Value!.Id}", result.Value),
                ServiceResultType.InvalidInput => BadRequest(new { Message = result.ErrorMessage }),
                ServiceResultType.Conflict => Conflict(new { Message = result.ErrorMessage }),
                ServiceResultType.Unauthorized => Unauthorized(new { Message = result.ErrorMessage }),
                ServiceResultType.Forbidden => Forbid(), // Forbid returns 403 without a body
                _ => StatusCode(StatusCodes.Status500InternalServerError, new { Message = result.ErrorMessage ?? "Ein unerwarteter Fehler ist aufgetreten." })
            };
        }
    }
}