const express = require('express');
const router = express.Router();

const { upload, uploadEventImage, uploadLogo, uploadLogoImage, uploadFavicon, uploadFaviconImage } = require('../controllers/uploadController');
const { protect, supervisor, admin } = require('../middleware/authMiddleware');
const prisma = require('../config/db');

// @route POST /api/uploads/event-image
// @desc Upload an image for an event
// @access Private (Supervisor+ recommended)
router.post('/event-image', protect, supervisor, (req, res, next) => {
    upload.single('image')(req, res, (err) => {
        if (err) {
            req.multerError = err;
        }
        next();
    });
}, uploadEventImage);

// Shared access rule for branding assets (logo, favicon): admin, OR allowed
// during first-time setup (no users yet).
async function brandingAssetAccess(req, res, next) {
    try {
        const count = await prisma.user.count();
        if (count === 0) return next(); // first-time setup
        return protect(req, res, () => admin(req, res, next));
    } catch {
        return protect(req, res, () => admin(req, res, next));
    }
}

// @route POST /api/uploads/logo
// @desc Upload site logo — admin, OR allowed during first-time setup (no users yet)
// @access Admin or setup
router.post('/logo', brandingAssetAccess, (req, res, next) => {
    uploadLogo.single('image')(req, res, (err) => {
        if (err) req.multerError = err;
        next();
    });
}, uploadLogoImage);

// @route POST /api/uploads/favicon
// @desc Upload site favicon — admin, OR allowed during first-time setup (no users yet)
// @access Admin or setup
router.post('/favicon', brandingAssetAccess, (req, res, next) => {
    uploadFavicon.single('image')(req, res, (err) => {
        if (err) req.multerError = err;
        next();
    });
}, uploadFaviconImage);

module.exports = router;