/**
 * @openapi
 * /api/organizations:
 *   get:
 *     tags: [Organizations]
 *     summary: List organizations (tenant-scoped)
 *     description: Requires READ_ORGANIZATIONS.
 *     responses:
 *       200:
 *         description: List payload.
 *         content:
 *           application/json:
 *             schema: { $ref: '#/components/schemas/ListResponse' }
 *       401: { $ref: '#/components/responses/UnauthorizedError' }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 *   post:
 *     tags: [Organizations]
 *     summary: Create a organizations record
 *     description: Requires CREATE_ORGANIZATIONS.
 *     responses:
 *       200: { description: Created. }
 *       400: { $ref: '#/components/responses/ValidationError' }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 * /api/organizations/count:
 *   get:
 *     tags: [Organizations]
 *     summary: Count organizations
 *     description: Requires READ_ORGANIZATIONS.
 *     responses:
 *       200: { description: Count. }
 * /api/organizations/autocomplete:
 *   get:
 *     tags: [Organizations]
 *     summary: Autocomplete organizations
 *     description: Requires READ_ORGANIZATIONS.
 *     responses:
 *       200: { description: Autocomplete results. }
 * /api/organizations/bulk-import:
 *   post:
 *     tags: [Organizations]
 *     summary: Bulk-import organizations from CSV
 *     description: Requires CREATE_ORGANIZATIONS.
 *     responses:
 *       200: { description: Imported. }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 * /api/organizations/deleteByIds:
 *   post:
 *     tags: [Organizations]
 *     summary: Delete multiple organizations records
 *     description: Requires DELETE_ORGANIZATIONS.
 *     responses:
 *       200: { description: Deleted. }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 * /api/organizations/{id}:
 *   get:
 *     tags: [Organizations]
 *     summary: Get a organizations record by id
 *     description: Requires READ_ORGANIZATIONS.
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema: { type: string, format: uuid }
 *     responses:
 *       200: { description: The record. }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 *       404: { description: Not found. }
 *   put:
 *     tags: [Organizations]
 *     summary: Update a organizations record
 *     description: Requires UPDATE_ORGANIZATIONS.
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema: { type: string, format: uuid }
 *     responses:
 *       200: { description: Updated. }
 *       400: { $ref: '#/components/responses/ValidationError' }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 *   delete:
 *     tags: [Organizations]
 *     summary: Delete a organizations record
 *     description: Requires DELETE_ORGANIZATIONS.
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema: { type: string, format: uuid }
 *     responses:
 *       200: { description: Deleted. }
 *       403: { $ref: '#/components/responses/ForbiddenError' }
 */
import express, { type RequestHandler } from 'express';
import controller from '@/api/controllers/organizations.controller';
import { createCrudRouter } from '@/api/http/crud-router';
import { assertCanDeleteOrganization } from '@/services/shared/role-policy';

const router = express.Router();

/**
 * Relational policy (Workstream 3 §3.3): only `super_admin` / `system_admin` /
 * `owner` may delete a company. A `superintendent` is blocked even though it
 * holds `DELETE_ORGANIZATIONS` — the "cannot delete the company" rule cannot be
 * expressed as a flat permission. Runs before the generic CRUD permission check.
 */
const guardOrganizationDelete: RequestHandler = (req, _res, next) => {
  try {
    assertCanDeleteOrganization(req.currentUser);
    next();
  } catch (error) {
    next(error);
  }
};

router.delete('/:id', guardOrganizationDelete);
router.post('/deleteByIds', guardOrganizationDelete);

router.use(createCrudRouter(controller, { permission: 'organizations' }));

export default router;
