/**
 * /admin/users/* (mounted at /admin — PLANNING.md §4b). User management is
 * superadmin-only (§14 Q4) — except the self-service password change, which any
 * authenticated admin may call for their own id (the service enforces that).
 */
import { Router } from 'express';
import { asyncHandler } from '../../lib/asyncHandler';
import { authenticate } from '../../middleware/authenticate';
import { requireRole } from '../../middleware/authorize';
import * as users from './user.controller';

export const userAdminRouter = Router();

userAdminRouter.use(authenticate);

// Self-service (own account) or superadmin force-reset — before the role gate.
userAdminRouter.post('/users/:id/password', asyncHandler(users.changePassword));

// Everything else: superadmin only.
userAdminRouter.use(requireRole('superadmin'));
userAdminRouter.get('/users', asyncHandler(users.list));
userAdminRouter.post('/users', asyncHandler(users.create));
userAdminRouter.get('/users/:id', asyncHandler(users.detail));
userAdminRouter.patch('/users/:id', asyncHandler(users.patch));