package dev.lions.unionflow.server.payment.pispi.readiness;

import dev.lions.unionflow.server.payment.pispi.readiness.PispiReadinessService.ReadinessReport;
import dev.lions.unionflow.server.payment.pispi.readiness.PispiReadinessService.ReadinessStatus;
import io.quarkus.security.Authenticated;
import jakarta.annotation.security.RolesAllowed;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;
import jakarta.ws.rs.core.Response;

/**
 * Endpoint d'inspection PI-SPI Readiness — usage ops/compliance avant activation production.
 *
 * <p>Status HTTP miroir du {@link ReadinessStatus} :
 * <ul>
 *   <li>200 — READY (tout configuré, prêt pour prod)</li>
 *   <li>200 — DEGRADED (warnings non bloquants — sandbox OK, prod à risque)</li>
 *   <li>503 — BLOCKED (au moins un blocage critique — sandbox impossible)</li>
 * </ul>
 *
 * @since 2026-04-25 (P1-NEW-15)
 */
@Path("/api/admin/pispi/readiness")
@Produces(MediaType.APPLICATION_JSON)
@Authenticated
public class PispiReadinessResource {

  @Inject PispiReadinessService readinessService;

  @GET
  @RolesAllowed({"SUPER_ADMIN", "COMPLIANCE_OFFICER"})
  public Response getReadiness() {
    ReadinessReport report = readinessService.verifierReadiness();
    int status = report.globalStatus() == ReadinessStatus.BLOCKED
        ? Response.Status.SERVICE_UNAVAILABLE.getStatusCode()
        : Response.Status.OK.getStatusCode();
    return Response.status(status).entity(report).build();
  }
}
