Core_Be/Controllers/BookingController.cs

using Fitness_core_BE.DTOs.Booking;
using Fitness_core_BE.Helpers;
using Fitness_core_BE.Interfaces.Services;
using Fitness_core_BE.Models.IOs;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using static Fitness_core_BE.Helpers.JwtMiddleware;
using static Fitness_core_BE.Helpers.ApiResponseHelper;

namespace Fitness_core_BE.Controllers
{
    // Booking spans three audiences with very different auth needs, so routes are absolute
    // per-action rather than grouped under one controller-level [Route] prefix: "api/app/..."
    // for logged-in members (same convention as CustomerController), "api/public/..." for a
    // non-member's anonymous guest booking, "api/client/..." for staff (check-in, cancel,
    // session roster, manual payment recording).
    [ApiController]
    public class BookingController : ControllerBase
    {
        private readonly IBookingService _bookingService;

        public BookingController(IBookingService bookingService)
        {
            _bookingService = bookingService;
        }

        // ---------- Member (logged-in) ----------

        [CustomMiddleware]
        [TenantResolution]
        [HttpPost("api/app/bookings")]
        public async Task<ActionResult<ApiResponse<object>>> CreateMemberBooking([FromBody] CreateMemberBookingRequest request)
            => Response(await _bookingService.CreateMemberBooking(new { facilitySessionId = request.FacilitySessionId }, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpGet("api/app/bookings/mine")]
        public async Task<ActionResult<ApiResponse<object>>> GetMyBookings()
            => Response(await _bookingService.GetMyBookings(new { }, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpPost("api/app/bookings/{id:guid}/cancel")]
        public async Task<ActionResult<ApiResponse<object>>> CancelMyBooking(Guid id)
            => Response(await _bookingService.CancelBooking(new { bookingId = id }, HttpContext));

        // ---------- Guest (no account at all) ----------

        [AllowAnonymous]
        [HttpPost("api/public/bookings/guest")]
        public async Task<ActionResult<ApiResponse<object>>> CreateGuestBooking([FromBody] CreateGuestBookingRequest request)
            => Response(await _bookingService.CreateGuestBooking(new
            {
                facilitySessionId = request.FacilitySessionId,
                guestName = request.GuestName,
                guestPhone = request.GuestPhone
            }, HttpContext));

        // The actual "copy the link and share it" page -- BookingDto.ShareUrl points here.
        // Plain HTML, not the JSON ApiResponse envelope, since this is meant to be opened
        // directly in a browser (or a chat app's link preview), not consumed by a client SDK.
        [AllowAnonymous]
        [HttpGet("api/public/bookings/{id:guid}/view")]
        public async Task<ContentResult> ViewBooking(Guid id)
        {
            var booking = await _bookingService.GetBookingView(new { bookingId = id }) as BookingDto;
            if (booking == null)
                return Content(BookingViewHtml.NotFound(), "text/html");

            return Content(BookingViewHtml.Render(booking), "text/html");
        }

        // ---------- Staff ----------

        [CustomMiddleware]
        [TenantResolution]
        [RequiresPermission("bookings")]
        [HttpGet("api/client/bookings/session/{facilitySessionId:guid}")]
        public async Task<ActionResult<ApiResponse<object>>> GetSessionBookings(Guid facilitySessionId)
            => Response(await _bookingService.GetSessionBookings(new { facilitySessionId }, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [RequiresPermission("bookings")]
        [HttpPost("api/client/bookings/check-in")]
        public async Task<ActionResult<ApiResponse<object>>> CheckInBooking([FromBody] CheckInBookingRequest request)
            => Response(await _bookingService.CheckInBooking(new { otpCode = request.OtpCode }, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [RequiresPermission("bookings")]
        [HttpPost("api/client/bookings/{id:guid}/mark-paid")]
        public async Task<ActionResult<ApiResponse<object>>> MarkGuestBookingPaid(Guid id, [FromBody] MarkGuestBookingPaidRequest request)
            => Response(await _bookingService.MarkGuestBookingPaid(new { bookingId = id, amountCharged = request.AmountCharged }, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [RequiresPermission("bookings")]
        [HttpPost("api/client/bookings/{id:guid}/cancel")]
        public async Task<ActionResult<ApiResponse<object>>> CancelBooking(Guid id)
            => Response(await _bookingService.CancelBooking(new { bookingId = id }, HttpContext));
    }
}