ERP_Distribution/Distribution/Features/SupplierClaims/SupplierClaimController.cs

using Distribution.Infra.Authorization;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Distribution.Features.SupplierClaims;

[ApiController]
public class SupplierClaimController(SupplierClaimService service, ICurrentUserService currentUser) : ControllerBase
{
    [HttpGet("api/supplier-claims")]
    [Authorize("supplier-claim.view")]
    public async Task<IActionResult> GetAll() =>
        Ok(await service.GetAllAsync());

    [HttpGet("api/supplier-claims/{id:guid}")]
    [Authorize("supplier-claim.view")]
    public async Task<IActionResult> GetById(Guid id)
    {
        var result = await service.GetByIdAsync(id);
        return result is null ? NotFound() : Ok(result);
    }

    [HttpGet("api/purchase-orders/{id:guid}/claims")]
    [Authorize("supplier-claim.view")]
    public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
        Ok(await service.GetByPurchaseOrderIdAsync(id));

    [HttpPost("api/purchase-orders/{id:guid}/claims")]
    [Authorize("supplier-claim.manage")]
    public async Task<IActionResult> Create(Guid id, CreateSupplierClaimRequest request, CancellationToken ct)
    {
        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
        var userId = currentUser.UserId ?? request.RaisedByUserId;
        if (userId is null) return BadRequest(new { error = "RaisedByUserId is required while auth is unavailable" });
        try
        {
            var result = await service.CreateAsync(id, request, userId.Value, ct);
            return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
        }
        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
    }

    [HttpPut("api/supplier-claims/{id:guid}")]
    [Authorize("supplier-claim.manage")]
    public async Task<IActionResult> Update(Guid id, UpdateSupplierClaimRequest request, CancellationToken ct)
    {
        try
        {
            var result = await service.UpdateAsync(id, request, ct);
            return Ok(result);
        }
        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
    }

    [HttpPost("api/supplier-claims/{id:guid}/approve")]
    [Authorize("supplier-claim.manage")]
    public async Task<IActionResult> Approve(Guid id, ApproveSupplierClaimRequest request, CancellationToken ct)
    {
        var userId = currentUser.UserId ?? request.ApprovedByUserId;
        if (userId is null) return BadRequest(new { error = "ApprovedByUserId is required while auth is unavailable" });
        try
        {
            var result = await service.ApproveAsync(id, request, userId.Value, ct);
            return Ok(result);
        }
        catch (KeyNotFoundException) { return NotFound(); }
        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
    }

    [HttpPost("api/supplier-claims/{id:guid}/reject")]
    [Authorize("supplier-claim.manage")]
    public async Task<IActionResult> Reject(Guid id, RejectSupplierClaimRequest request, CancellationToken ct)
    {
        var userId = currentUser.UserId ?? request.RejectedByUserId;
        if (userId is null) return BadRequest(new { error = "RejectedByUserId is required while auth is unavailable" });
        try
        {
            var result = await service.RejectAsync(id, request, userId.Value, ct);
            return Ok(result);
        }
        catch (KeyNotFoundException) { return NotFound(); }
        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
    }
}