using Management.Data;
using Management.Security;
using Microsoft.AspNetCore.Mvc;

namespace Management.Controllers.Admin;

/// <summary>
/// Admin endpoints for session management.
/// Requires Admin role.
/// 
/// ENDPOINTS:
/// GET  /api/admin/sessions                    - List sessions
/// POST /api/admin/sessions/{id}/revoke        - Revoke session
/// POST /api/admin/users/{id}/revoke-sessions  - Revoke all user sessions
/// POST /api/admin/sessions/cleanup            - Cleanup expired sessions
/// </summary>
[ApiController]
[Route("api/admin/sessions")]
public sealed class AdminSessionsController : AdminControllerBase
{
    public AdminSessionsController(SqlService sql, ClientContext client, ILogger<AdminSessionsController> log)
        : base(sql, client, log) { }

    /// <summary>
    /// List sessions with optional filtering.
    /// </summary>
    [HttpGet]
    public Task<IActionResult> List(
        [FromQuery] string? clientId,
        [FromQuery] string? userId,
        [FromQuery] bool activeOnly = true,
        [FromQuery] int limit = 100,
        CancellationToken ct = default)
        => CallProc("spAdminSessions", "list", new { clientId, userId, activeOnly, limit }, ct);

    /// <summary>
    /// Revoke a session.
    /// </summary>
    [HttpPost("{sessionId}/revoke")]
    public Task<IActionResult> Revoke(string sessionId, CancellationToken ct)
    {
        Logger.LogWarning("[Admin] RevokeSession | SessionId={SessionId} | By={User}", sessionId, Client.Email);
        return CallProc("spAdminSessions", "revoke", new { sessionId }, ct);
    }

    /// <summary>
    /// Revoke all sessions for a user.
    /// </summary>
    [HttpPost("~/api/admin/users/{userId}/revoke-sessions")]
    public Task<IActionResult> RevokeAllForUser(string userId, CancellationToken ct)
    {
        Logger.LogWarning("[Admin] RevokeAllSessions | UserId={UserId} | By={User}", userId, Client.Email);
        return CallProc("spAdminSessions", "revokeAllForUser", new { userId }, ct);
    }

    /// <summary>
    /// Cleanup expired sessions.
    /// </summary>
    [HttpPost("cleanup")]
    public Task<IActionResult> Cleanup([FromQuery] int daysOld = 30, CancellationToken ct = default)
    {
        Logger.LogWarning("[Admin] CleanupSessions | DaysOld={DaysOld} | By={User}", daysOld, Client.Email);
        return CallProc("spAdminSessions", "cleanup", new { daysOld }, ct);
    }
}