module Api
  # Everything about who has access to a document. Owner only.
  class SharesController < BaseController
    before_action :require_authentication
    before_action :load_owned_document

    # GET /api/documents/:document_id/share
    def show
      render json: share_json
    end

    # POST /api/documents/:document_id/share/links { role }
    # One active link per role: creating one replaces (revokes) the previous.
    def create_link
      role = params.require(:role)
      return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless ShareLink.roles.key?(role)
      @doc.transaction do
        @doc.share_links.active.where(role:).find_each(&:revoke!)
        @doc.share_links.create!(role:, created_by: Current.user)
      end
      render json: share_json
    end

    # DELETE /api/documents/:document_id/share/links/:id
    def revoke_link
      @doc.share_links.active.find(params[:id]).revoke!
      render json: share_json
    end

    # POST /api/documents/:document_id/share/invitations { email, role }
    def invite
      role = params.require(:role)
      return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless MagicLink.roles.key?(role)
      link = MagicLink.issue!(email: params.require(:email), purpose: :invitation, document: @doc, role:, invited_by: Current.user)
      if link.email == Current.user.email
        link.destroy!
        return render(json: { error: "self_invite" }, status: :unprocessable_entity)
      end
      AuthMailer.invitation(link, link.token).deliver_later
      render json: share_json
    end

    # PATCH /api/documents/:document_id/share/members/:user_id { role }
    def update_member
      m = @doc.document_memberships.find_by!(user_id: params[:user_id])
      m.update!(role: params.require(:role))
      render json: share_json
    end

    # DELETE /api/documents/:document_id/share/members/:user_id
    def remove_member
      @doc.document_memberships.where(user_id: params[:user_id]).delete_all
      render json: share_json
    end

    private

    def load_owned_document
      @doc = Current.user.owned_documents.find(params[:document_id])
    end

    def share_json
      {
        links: @doc.share_links.active.order(:created_at).map(&:as_json),
        members: @doc.document_memberships.includes(:user).order(:created_at).map do |m|
          { user_id: m.user_id, name: m.user.name, email: m.user.email, role: m.role, source: m.source }
        end,
        invitations: MagicLink.usable.invitation.where(document: @doc).order(:created_at).map do |i|
          { email: i.email, role: i.role, expires_at: i.expires_at.iso8601 }
        end
      }
    end
  end
end