dyolink/backend/src/modules/staff/staff.controller.ts

import {
  Body,
  Controller,
  Delete,
  Get,
  Param,
  Patch,
  Post,
  Query,
  Req,
  UseGuards,
} from '@nestjs/common';
import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
import { AcceptStaffInviteDto } from './dto/accept-staff-invite.dto';
import { InviteStaffDto } from './dto/invite-staff.dto';
import { PreviewStaffInviteDto } from './dto/preview-staff-invite.dto';
import { UpdateStaffMemberDto } from './dto/update-staff-member.dto';
import { StaffService } from './staff.service';

@ApiTags('staff')
@ApiBearerAuth('JWT-auth')
@Controller('staff')
export class StaffController {
  constructor(private readonly staffService: StaffService) {}

  @Get('invitations/preview')
  @ApiOperation({ summary: 'Preview invite info by token (public)' })
  previewInvite(@Query() query: PreviewStaffInviteDto) {
    return this.staffService.previewInvite(query.token);
  }

  @Post('invitations/accept')
  @ApiOperation({ summary: 'Accept invite and activate account (public)' })
  acceptInvite(@Body() dto: AcceptStaffInviteDto) {
    return this.staffService.acceptInvite(dto);
  }

  @Get()
  @UseGuards(JwtAuthGuard)
  @ApiOperation({ summary: 'List organization members (requires TAB_STAFF_READ or owner)' })
  list(@Req() req: { user: { id: string; organizationId?: string } }) {
    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
    return this.staffService.list(req.user.id, organizationId);
  }

  @Post('invite')
  @UseGuards(JwtAuthGuard)
  @ApiOperation({ summary: 'Invite staff (requires TAB_STAFF_EDIT or owner)' })
  invite(
    @Req() req: { user: { id: string; organizationId?: string } },
    @Body() dto: InviteStaffDto,
  ) {
    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
    return this.staffService.invite(req.user.id, organizationId, dto);
  }

  @Patch('members/:membershipId')
  @UseGuards(JwtAuthGuard)
  @ApiOperation({ summary: 'Update staff member name and/or permissions' })
  updateMember(
    @Req() req: { user: { id: string; organizationId?: string } },
    @Param('membershipId') membershipId: string,
    @Body() dto: UpdateStaffMemberDto,
  ) {
    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
    return this.staffService.updateMember(req.user.id, organizationId, membershipId, dto);
  }

  @Delete('members/:membershipId')
  @UseGuards(JwtAuthGuard)
  @ApiOperation({ summary: 'Remove staff member from organization' })
  removeMember(
    @Req() req: { user: { id: string; organizationId?: string } },
    @Param('membershipId') membershipId: string,
  ) {
    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
    return this.staffService.removeMember(req.user.id, organizationId, membershipId);
  }
}