import type { FastifyInstance } from 'fastify';
import { submitHandler, listPendingHandler, listCancelledHandler, approveHandler, cancelHandler } from '../controllers/orderApproval.controller.js';
import { authorize } from '../plugins/authorize.js';
import { PERMISSIONS } from '../constants/permissions.js';
import { createOrderSchema } from '../schemas/order.schema.js';

export default async function orderApprovalRoutes(fastify: FastifyInstance) {
  // Same body shape/validation as POST /api/orders — anyone who can create
  // orders can submit one for approval, even without orders.approve itself.
  fastify.post(
    '/api/orders/approval-requests',
    { preHandler: [authorize(PERMISSIONS.ORDERS_CREATE)], schema: createOrderSchema },
    submitHandler,
  );
  fastify.get(
    '/api/orders/approval-requests',
    { preHandler: [authorize(PERMISSIONS.ORDERS_APPROVE)] },
    listPendingHandler,
  );
  fastify.get(
    '/api/orders/approval-requests/cancelled',
    { preHandler: [authorize(PERMISSIONS.ORDERS_APPROVE)] },
    listCancelledHandler,
  );
  fastify.post(
    '/api/orders/approval-requests/:id/approve',
    { preHandler: [authorize(PERMISSIONS.ORDERS_APPROVE)] },
    approveHandler,
  );
  fastify.post(
    '/api/orders/approval-requests/:id/cancel',
    { preHandler: [authorize(PERMISSIONS.ORDERS_APPROVE)] },
    cancelHandler,
  );
}