package router

import (
	"github.com/Tencent/WeKnora/internal/handler/workbench"
	"github.com/Tencent/WeKnora/internal/middleware"
	"github.com/Tencent/WeKnora/internal/types"
	"github.com/gin-gonic/gin"
)

// RegisterWorkbenchRoutes exposes native 私域Agent orchestration resources.
// It deliberately sits behind the same tenant RBAC middleware as native WeKnora
// KBs and agents; no legacy API or shared admin token is involved.
func RegisterWorkbenchRoutes(r *gin.RouterGroup, h *workbench.Handler, g *rbacGuards) {
	if h == nil {
		return
	}
	wb := r.Group("/workbench")
	// Viewer may read their own resources; mutating actions require Contributor.
	wb.GET("/modules", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Modules)
	wb.GET("/resources/:kind", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.List)
	wb.GET("/resources/:kind/:id", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Get)
	wb.GET("/resources/:kind/:id/export", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Export)
	wb.GET("/resources/:kind/:id/jobs", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Jobs)
	wb.POST("/resources/:kind", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.Create)
	wb.PUT("/resources/:kind/:id", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.Update)
	wb.DELETE("/resources/:kind/:id", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.Delete)
	wb.POST("/resources/:kind/:id/actions/:action", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.Action)
	wb.GET("/jobs/:id", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Job)
	wb.POST("/jobs/:id/:action", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.ControlJob)
	wb.GET("/notifications", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Notifications)
	wb.POST("/notifications/read-all", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.ReadAll)
	wb.GET("/balance", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.Balance)
	wb.GET("/operations/accounts", middleware.RequireRole(types.TenantRoleAdmin, g.cfg), h.Accounts)
	wb.POST("/operations/grants", middleware.RequireRole(types.TenantRoleAdmin, g.cfg), h.GrantBalance)
	wb.GET("/operations/quotas", middleware.RequireRole(types.TenantRoleAdmin, g.cfg), h.Quotas)
	wb.PUT("/operations/quotas/:userID", middleware.RequireRole(types.TenantRoleAdmin, g.cfg), h.SaveQuota)
	wb.DELETE("/operations/quotas/:id", middleware.RequireRole(types.TenantRoleAdmin, g.cfg), h.DeleteQuota)
	wb.GET("/operations/records/:recordKind", middleware.RequireRole(types.TenantRoleViewer, g.cfg), h.OperationRecords)
	wb.POST("/operations/consumption", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.UpdateConsumption)
	wb.POST("/operations/memories/:id", middleware.RequireRole(types.TenantRoleContributor, g.cfg), h.ReviewMemory)
}