Core_Be/Controllers/BootstrapController.cs

using Fitness_core_BE.Interfaces.Services;
using Fitness_core_BE.Models.IOs;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using static Fitness_core_BE.Helpers.ApiResponseHelper;

namespace Fitness_core_BE.Controllers
{
    // One-time setup only -- see BootstrapService for why this exists instead of the
    // multi-gym onboarding/activation flow. [AllowAnonymous] is safe here specifically because
    // the service itself refuses to run a second time once a Client row exists; there is no
    // window where this endpoint stays open as a standing unauthenticated write path.
    [ApiController]
    [Route("api/bootstrap")]
    public class BootstrapController : ControllerBase
    {
        private readonly IBootstrapService _bootstrapService;

        public BootstrapController(IBootstrapService bootstrapService)
        {
            _bootstrapService = bootstrapService;
        }

        public class BootstrapClubRequest
        {
            public Guid UserId { get; set; }
            public string ClientName { get; set; } = string.Empty;
            public string? ClientPhone { get; set; }
            public string? ClientEmail { get; set; }
        }

        [AllowAnonymous]
        [HttpPost("club")]
        public async Task<ActionResult<ApiResponse<object>>> BootstrapClub([FromBody] BootstrapClubRequest request)
            => Response(await _bootstrapService.BootstrapClub(new
            {
                userId = request.UserId,
                clientName = request.ClientName,
                clientPhone = request.ClientPhone,
                clientEmail = request.ClientEmail
            }));
    }
}