Core_Be/Controllers/GymRoleController.cs

using Fitness_core_BE.DTOs.Rbac;
using Fitness_core_BE.Helpers;
using Fitness_core_BE.Interfaces.Services;
using Fitness_core_BE.Models.IOs;
using Microsoft.AspNetCore.Mvc;
using static Fitness_core_BE.Helpers.JwtMiddleware;
using static Fitness_core_BE.Helpers.ApiResponseHelper;

namespace Fitness_core_BE.Controllers
{
    // Owner-only role management. No [RequiresPermission] here on purpose — enforcement
    // lives inside IGymRoleService itself (every method requires resolving as the gym
    // owner), so no staff nav-section permission can ever unlock these actions.
    [ApiController]
    [Route("api/client/roles")]
    public class GymRoleController : ControllerBase
    {
        private readonly IGymRoleService _gymRoleService;

        public GymRoleController(IGymRoleService gymRoleService)
        {
            _gymRoleService = gymRoleService;
        }

        [CustomMiddleware]
        [TenantResolution]
        [HttpGet("")]
        public async Task<ActionResult<ApiResponse<List<GymRoleDto>>>> GetRoles()
            => Response(await _gymRoleService.GetRolesAsync(HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpPost("")]
        public async Task<ActionResult<ApiResponse<GymRoleDto>>> CreateRole([FromBody] CreateGymRoleRequest request)
            => Response(await _gymRoleService.CreateRoleAsync(request, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpPut("{id:guid}")]
        public async Task<ActionResult<ApiResponse<GymRoleDto>>> UpdateRole(Guid id, [FromBody] UpdateGymRoleRequest request)
            => Response(await _gymRoleService.UpdateRoleAsync(id, request, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpDelete("{id:guid}")]
        public async Task<ActionResult<ApiResponse<object>>> DeleteRole(Guid id)
        {
            await _gymRoleService.DeleteRoleAsync(id, HttpContext);
            return Response<object>(new { deleted = true });
        }

        [CustomMiddleware]
        [TenantResolution]
        [HttpPut("{id:guid}/permissions")]
        public async Task<ActionResult<ApiResponse<GymRoleDto>>> SetRolePermissions(Guid id, [FromBody] SetRolePermissionsRequest request)
            => Response(await _gymRoleService.SetRolePermissionsAsync(id, request, HttpContext));

        [CustomMiddleware]
        [TenantResolution]
        [HttpPut("~/api/client/staff/{staffId:guid}/role")]
        public async Task<ActionResult<ApiResponse<object>>> AssignStaffRole(Guid staffId, [FromBody] AssignStaffRoleRequest request)
        {
            await _gymRoleService.AssignStaffRoleAsync(staffId, request, HttpContext);
            return Response<object>(new { assigned = true });
        }
    }
}