"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __param = (this && this.__param) || function (paramIndex, decorator) {
    return function (target, key) { decorator(target, key, paramIndex); }
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.AuthController = void 0;
const common_1 = require("@nestjs/common");
const swagger_1 = require("@nestjs/swagger");
const client_1 = require("@prisma/client");
const current_user_decorator_1 = require("../common/current-user.decorator");
const swagger_docs_1 = require("../common/swagger-docs");
const auth_service_1 = require("./auth.service");
const auth_throttle_decorator_1 = require("./auth-throttle.decorator");
const auth_dto_1 = require("./dto/auth.dto");
const public_decorator_1 = require("./public.decorator");
const require_role_decorator_1 = require("./require-role.decorator");
let AuthController = class AuthController {
    authService;
    constructor(authService) {
        this.authService = authService;
    }
    login(dto) {
        return this.authService.login(dto);
    }
    verifyOtp(dto) {
        return this.authService.verifyOtp(dto);
    }
    refresh(dto) {
        return this.authService.refresh(dto);
    }
    signup(dto, user) {
        return this.authService.signup(dto, user);
    }
};
exports.AuthController = AuthController;
__decorate([
    (0, common_1.Post)('login'),
    (0, public_decorator_1.Public)(),
    (0, auth_throttle_decorator_1.AuthThrottle)(),
    (0, swagger_1.ApiOperation)({
        summary: 'Request OTP for login',
        description: 'Starts OTP login for a registered and active user. Delivery is controlled by the super-admin OTP configuration: DEV, Termii, Africa\'s Talking, or a custom HTTP SMS endpoint.'
    }),
    (0, swagger_1.ApiBody)({
        type: auth_dto_1.LoginDto,
        examples: {
            superAdmin: { summary: 'Seeded super admin', value: { phone: '+2348000000001' } },
            salesAdmin: { summary: 'Seeded sales admin', value: { phone: '+2348000000005' } },
            estateAdmin: { summary: 'Seeded estate admin', value: { phone: '+2348000000002' } },
            resident: { summary: 'Seeded resident', value: { phone: '+2348000000003' } },
            guard: { summary: 'Seeded guard', value: { phone: '+2348000000004' } }
        }
    }),
    (0, swagger_1.ApiResponse)({
        status: 201,
        description: 'OTP sent successfully',
        schema: {
            example: {
                message: 'OTP sent',
                provider: 'DEV',
                providerPriority: ['DEV'],
                expiresInSeconds: 300,
                devOtp: '123456'
            }
        }
    }),
    (0, swagger_1.ApiUnauthorizedResponse)({
        description: 'Phone number does not exist, or the account is suspended or disabled.',
        schema: { example: { statusCode: 401, message: 'No account exists for this phone number', error: 'Unauthorized' } }
    }),
    (0, swagger_docs_1.ApiAuthThrottleError)(),
    (0, swagger_docs_1.ApiValidationError)(),
    __param(0, (0, common_1.Body)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [auth_dto_1.LoginDto]),
    __metadata("design:returntype", void 0)
], AuthController.prototype, "login", null);
__decorate([
    (0, common_1.Post)('verify-otp'),
    (0, public_decorator_1.Public)(),
    (0, auth_throttle_decorator_1.AuthThrottle)(),
    (0, swagger_1.ApiOperation)({
        summary: 'Verify OTP and receive tokens',
        description: 'Verifies the OTP for the selected provider, rejects inactive accounts, stores a hashed refresh token, and returns access and refresh JWTs.'
    }),
    (0, swagger_1.ApiBody)({
        type: auth_dto_1.VerifyOtpDto,
        examples: {
            seededSuperAdmin: { summary: 'Seeded super admin login in DEV mode', value: { phone: '+2348000000001', otp: '123456' } }
        }
    }),
    (0, swagger_1.ApiResponse)({
        status: 201,
        description: 'OTP verified, tokens issued',
        schema: {
            example: {
                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
                refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
            }
        }
    }),
    (0, swagger_1.ApiUnauthorizedResponse)({
        description: 'OTP is invalid, user does not exist, or account is inactive.',
        schema: { example: { statusCode: 401, message: 'Invalid OTP', error: 'Unauthorized' } }
    }),
    (0, swagger_docs_1.ApiAuthThrottleError)(),
    (0, swagger_docs_1.ApiValidationError)(),
    __param(0, (0, common_1.Body)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [auth_dto_1.VerifyOtpDto]),
    __metadata("design:returntype", void 0)
], AuthController.prototype, "verifyOtp", null);
__decorate([
    (0, common_1.Post)('refresh'),
    (0, public_decorator_1.Public)(),
    (0, auth_throttle_decorator_1.AuthThrottle)(),
    (0, swagger_1.ApiOperation)({
        summary: 'Refresh access and refresh tokens',
        description: 'Validates the refresh JWT and compares it against the bcrypt hash stored on the user before rotating both tokens.'
    }),
    (0, swagger_1.ApiBody)({ type: auth_dto_1.RefreshTokenDto }),
    (0, swagger_1.ApiResponse)({
        status: 201,
        description: 'New tokens issued',
        schema: {
            example: {
                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
                refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
            }
        }
    }),
    (0, swagger_1.ApiUnauthorizedResponse)({
        description: 'Refresh token is invalid, expired, revoked, or account is inactive.',
        schema: { example: { statusCode: 401, message: 'Invalid refresh token', error: 'Unauthorized' } }
    }),
    (0, swagger_docs_1.ApiAuthThrottleError)(),
    (0, swagger_docs_1.ApiValidationError)(),
    __param(0, (0, common_1.Body)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [auth_dto_1.RefreshTokenDto]),
    __metadata("design:returntype", void 0)
], AuthController.prototype, "refresh", null);
__decorate([
    (0, common_1.Post)('signup'),
    (0, require_role_decorator_1.RequireRole)(client_1.UserRole.SUPER_ADMIN, client_1.UserRole.ESTATE_ADMIN, client_1.UserRole.SECURITY_SUPERVISOR),
    (0, swagger_docs_1.ApiProtectedEndpoint)(),
    (0, swagger_1.ApiBearerAuth)('bearer'),
    (0, swagger_1.ApiOperation)({
        summary: 'Create a user account and role profile',
        description: 'Creates users for supported roles using an authenticated admin or security supervisor. Residents get a resident profile; guards get a guard profile. Role creation is limited by the creator role.'
    }),
    (0, swagger_1.ApiBody)({
        type: auth_dto_1.SignupDto,
        examples: {
            resident: {
                summary: 'Create resident',
                value: { estateId: swagger_docs_1.ESTATE_ID_EXAMPLE, name: 'Ade Okafor', phone: '+2348000000100', role: 'RESIDENT', unit: 'B14' }
            },
            guard: {
                summary: 'Create guard',
                value: {
                    estateId: swagger_docs_1.ESTATE_ID_EXAMPLE,
                    name: 'Ade Okafor',
                    phone: '+2348000000101',
                    role: 'GUARD',
                    deviceId: 'guard-device-010'
                }
            },
            supervisor: {
                summary: 'Create security supervisor',
                value: { estateId: swagger_docs_1.ESTATE_ID_EXAMPLE, name: 'Security Supervisor', phone: '+2348000000102', role: 'SECURITY_SUPERVISOR' }
            },
            salesAdmin: {
                summary: 'Create sales admin',
                value: { name: 'Ade Okafor', phone: '+2348000000103', role: 'SALES_ADMIN' }
            }
        }
    }),
    (0, swagger_1.ApiResponse)({
        status: 201,
        description: 'User account created. Related resident or guard profile is included when applicable.',
        schema: {
            example: {
                user: {
                    id: 'user-uuid',
                    estateId: swagger_docs_1.ESTATE_ID_EXAMPLE,
                    phone: '+2348000000100',
                    name: 'Ade Okafor',
                    role: 'RESIDENT',
                    status: 'ACTIVE'
                },
                resident: {
                    id: 'resident-uuid',
                    estateId: swagger_docs_1.ESTATE_ID_EXAMPLE,
                    unit: 'B14'
                }
            }
        }
    }),
    (0, swagger_1.ApiBadRequestResponse)({
        description: 'Missing role-specific fields such as unit for RESIDENT, or validation failure.',
        schema: { example: { statusCode: 400, message: 'unit is required when signing up a resident', error: 'Bad Request' } }
    }),
    (0, swagger_1.ApiConflictResponse)({
        description: 'Phone number already belongs to an existing user.',
        schema: { example: { statusCode: 409, message: 'A user with this phone number already exists', error: 'Conflict' } }
    }),
    (0, swagger_1.ApiForbiddenResponse)({
        description: 'Creator role cannot create the requested role or estate scope is invalid.',
        schema: { example: { statusCode: 403, message: 'You cannot create users with role SUPER_ADMIN', error: 'Forbidden' } }
    }),
    __param(0, (0, common_1.Body)()),
    __param(1, (0, current_user_decorator_1.CurrentUser)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [auth_dto_1.SignupDto, Object]),
    __metadata("design:returntype", void 0)
], AuthController.prototype, "signup", null);
exports.AuthController = AuthController = __decorate([
    (0, swagger_1.ApiTags)('Auth'),
    (0, common_1.Controller)({ path: 'auth', version: '1' }),
    __metadata("design:paramtypes", [auth_service_1.AuthService])
], AuthController);
//# sourceMappingURL=auth.controller.js.map