import express from 'express';
import { getCurrentUser, getAllUsers, updateUserRole, toggleBanUser, heartbeat, getActiveUsers, deleteUser, login } from '../controllers/userController.js';
import { requireAdmin } from '../middleware/authMiddleware.js';

const router = express.Router();

// Public routes (no auth required originally, but now all API has extractUser)
// Only users should see all users
router.get('/', getAllUsers);
router.get('/me', getCurrentUser);
router.post('/login', login);

// Heartbeat & Presence
router.post('/heartbeat', heartbeat);
router.get('/active', getActiveUsers);

// Admin routes
router.patch('/:id/role', requireAdmin, updateUserRole);
router.patch('/:id/ban', requireAdmin, toggleBanUser);
router.delete('/:id', requireAdmin, deleteUser);

export default router;
