import { Hono } from 'hono';
import suggestionsRouter from './suggestions.js';
import notifyRouter from './notify.js';
import type { AuthUser } from '../../auth/types.js';
import { canAccessScheduling } from '../../auth/types.js';

const app = new Hono();

// Module-level access guard (fail-closed): requires BI-SCHEDULE-OPT.
// Auth middleware runs before this router, so a missing `user` is an anomaly and
// must be treated as "no permission" rather than silently allowed.
app.use('*', async (c, next) => {
  const user = (c as any).get('user') as AuthUser | undefined;
  if (!canAccessScheduling(user?.roles)) {
    return c.json({ error: 'Forbidden: 智能调度访问需要 BI-SCHEDULE-OPT 角色' }, 403);
  }
  return next();
});

app.route('/suggestions', suggestionsRouter);
app.route('/notify', notifyRouter);

export default app;