using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Tiku.Application.Security;
using Tiku.Application.Tenancy;

namespace Tiku.Api.Controllers;

[ApiController]
[Route("api/tenant-onboarding")]
[Authorize(Policy = BackendPermissions.TenantSettingsManage)]
public sealed class TenantOnboardingController(
    ITenantOnboardingService onboardingService,
    ICurrentAccessContext accessContext) : ControllerBase
{
    [HttpGet("status")]
    public async Task<TenantOnboardingStatus> Status(CancellationToken cancellationToken)
    {
        var access = await accessContext.GetAsync(cancellationToken);
        if (access.TenantId is not { } tenantId || !access.IsCurrentTenantMember)
        {
            throw new TenantExternalProviderException("Tenant onboarding access is denied.", "tenant_access_denied");
        }
        return await onboardingService.GetStatusAsync(tenantId, cancellationToken);
    }
}