import { Routes } from '@angular/router';
import { ShellComponent } from '@shared/layout/shell/shell.component';
import { authGuard, capabilityGuard } from '@auth/auth.guard';

export const routes: Routes = [
  {
    path: '',
    component: ShellComponent, // persistent header/footer; only children swap
    children: [
      { path: '', pathMatch: 'full', redirectTo: 'login' },
      {
        path: 'login',
        loadComponent: () => import('@auth/ui/login.page').then((m) => m.LoginPage),
      },
      {
        path: 'dashboard',
        canActivate: [authGuard],
        loadComponent: () =>
          import('@behandeling/ui/werkvoorraad.page').then((m) => m.WerkvoorraadPage),
      },
      {
        path: 'aanvraag/:id',
        // Same capability the werkvoorraad list itself is gated by — the
        // detail page is reachable only from a row already filtered to that capability.
        canActivate: [capabilityGuard('aanvraag:beoordelen')],
        loadComponent: () =>
          import('@behandeling/ui/beoordeling.page').then((m) => m.BeoordelingPage),
      },
      {
        path: 'beheer/stamdata',
        // Admin-only stamdata maintenance editor (ADR-0004): capabilityGuard denies-by-default
        // unless GET /me resolved `stamdata:edit` (Admin role). Backend re-enforces via the
        // StamdataAdmin gate — the guard just avoids loading a page that would 403.
        canActivate: [capabilityGuard('stamdata:edit')],
        loadComponent: () => import('@beheer/ui/stamdata.page').then((m) => m.StamdataPage),
      },
      {
        path: 'beheer/audit',
        // Admin-only authz/PII-reveal audit trail. capabilityGuard denies-by-default
        // unless GET /me resolved `cases:manage` (reused for audit read). Backend re-enforces.
        canActivate: [capabilityGuard('cases:manage')],
        loadComponent: () => import('@beheer/ui/audit.page').then((m) => m.AuditPage),
      },
      {
        path: 'beheer/functies',
        // Admin-only feature-flag toggles, gated by `flags:manage`.
        canActivate: [capabilityGuard('flags:manage')],
        loadComponent: () =>
          import('@beheer/ui/feature-flags.page').then((m) => m.FeatureFlagsPage),
      },
      { path: '**', redirectTo: 'login' },
    ],
  },
];