using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using JobTrackerApi.Services.JobImport;

namespace JobTrackerApi.Controllers;

[ApiController]
// Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
// depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
// would otherwise serve them anonymously. docs/production-readiness-review.md.
[Route("api/jobimport")]
[Authorize(AuthenticationSchemes = "local")]
public sealed class JobImportController : ControllerBase
{
    private readonly JobImportService _import;

    public JobImportController(JobImportService import)
    {
        _import = import;
    }

    public sealed record PreviewRequest(string Url);

    [HttpPost("preview")]
    public async Task<ActionResult<JobImportResult>> Preview([FromBody] PreviewRequest request, CancellationToken cancellationToken)
    {
        var result = await _import.PreviewAsync(request?.Url ?? "", cancellationToken);
        if (!result.Success) return BadRequest(result);
        return Ok(result);
    }
}