use axum::extract::State;
use jwt::extractor::AuthUser;

use db::conn::sea_orm::EntityTrait;
use db::user::users as user_entity;

use crate::error::AuthError;
use crate::features::AuthService;
use crate::features::login::types::UserMe;
use export::data::AppResponseData;

#[utoipa::path(
    get,
    path = "/auth/me",
    tag = "auth",
    responses(
        (status = 200, description = "Authenticated user profile (full view, including privileged fields).", body = AppResponseData<UserMe>),
        (status = 401, description = "Missing or invalid access token.", body = super::openapi::ErrorBody),
        (status = 404, description = "User not found.", body = super::openapi::ErrorBody),
    ),
    security(
        ("bearer_auth" = []),
    ),
)]
pub(crate) async fn handler(
    State(svc): State<AuthService>,
    AuthUser { claims }: AuthUser,
) -> Result<AppResponseData<UserMe>, AuthError> {
    let db = svc.db.writer();
    let model = user_entity::Entity::find_by_id(claims.sub)
        .one(&db)
        .await
        .map_err(AuthError::from)?
        .ok_or_else(|| AuthError::NotFound(format!("user {}", claims.sub)))?;
    Ok(AppResponseData::ok(UserMe::from(model)))
}