import {
  Controller, Post, Get, Patch, Body, Req, UseGuards, HttpCode, HttpStatus,
} from "@nestjs/common";
import { AuthService } from "./auth.service";
import { RegisterDto, LoginDto, RefreshDto, SetupMfaDto, ChangePasswordDto, UpdateProfileDto } from "./dto/auth.dto";
import { JwtAuthGuard } from "./guards/auth.guard";
import { CurrentUser } from "./decorators/current-user.decorator";

@Controller("auth")
export class AuthController {
  constructor(private auth: AuthService) {}

  /** POST /api/auth/register — Registro público (doc §09 paso 1) */
  @Post("register")
  register(@Body() dto: RegisterDto) {
    return this.auth.register(dto);
  }

  /** POST /api/auth/login — Login con JWT + MFA opcional */
  @Post("login")
  @HttpCode(HttpStatus.OK)
  login(@Body() dto: LoginDto, @Req() req: any) {
    return this.auth.login(dto, req.ip);
  }

  /** POST /api/auth/refresh — Rotar refresh token */
  @Post("refresh")
  @HttpCode(HttpStatus.OK)
  refresh(@Body() dto: RefreshDto) {
    return this.auth.refresh(dto.refreshToken);
  }

  /** POST /api/auth/logout */
  @Post("logout")
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.OK)
  logout(@Body() dto: RefreshDto, @CurrentUser() user: any) {
    return this.auth.logout(dto.refreshToken, user.id);
  }

  /** GET /api/auth/me — Perfil del usuario autenticado */
  @Get("me")
  @UseGuards(JwtAuthGuard)
  me(@CurrentUser() user: any) {
    return this.auth.getProfile(user.id);
  }

  /** PATCH /api/auth/me — Actualizar nombre / teléfono */
  @Patch("me")
  @UseGuards(JwtAuthGuard)
  updateProfile(@Body() dto: UpdateProfileDto, @CurrentUser() user: any) {
    return this.auth.updateProfile(user.id, dto);
  }

  /** PATCH /api/auth/password — Cambiar contraseña */
  @Patch("password")
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.OK)
  async changePassword(@Body() dto: ChangePasswordDto, @CurrentUser() user: any) {
    await this.auth.changePassword(user.id, dto.oldPassword, dto.newPassword);
    return { message: "Contraseña actualizada correctamente." };
  }

  /** POST /api/auth/mfa/setup — Genera QR para TOTP */
  @Post("mfa/setup")
  @UseGuards(JwtAuthGuard)
  setupMfa(@CurrentUser() user: any) {
    return this.auth.setupMfa(user.id);
  }

  /** POST /api/auth/mfa/verify — Activa MFA con primer código TOTP */
  @Post("mfa/verify")
  @UseGuards(JwtAuthGuard)
  verifyMfa(@Body() dto: SetupMfaDto, @CurrentUser() user: any) {
    return this.auth.verifyMfa(user.id, dto.totpCode);
  }

  /** POST /api/auth/mfa/disable — Desactiva MFA (requiere código TOTP) */
  @Post("mfa/disable")
  @UseGuards(JwtAuthGuard)
  disableMfa(@Body() dto: SetupMfaDto, @CurrentUser() user: any) {
    return this.auth.disableMfa(user.id, dto.totpCode);
  }
}