"""``/api/certificates`` — issuance, download, verify, progress."""

from fastapi import APIRouter, Depends

from app.core.auth import get_current_user
from app.types import CertificateRequest
from app.services.certificate_service import (
    handle_certificates,
    download_certificate_pdf,
    verify_certificate,
    cert_progress,
)


router = APIRouter()


@router.post("/api/certificates")
async def post_certificates(req: CertificateRequest, user: dict = Depends(get_current_user)):
    # IDOR FIX: Override user_id from JWT
    req.user_id = user["user_id"]
    return await handle_certificates(req)


@router.get("/api/certificates/{cert_id}/pdf")
async def get_certificate_pdf(cert_id: str, lang: str = "en"):
    return await download_certificate_pdf(cert_id, lang)


@router.get("/api/certificates/verify/{verify_code}")
async def get_verify(verify_code: str):
    return await verify_certificate(verify_code)


@router.get("/api/certificates/progress")
async def get_progress(user_id: str, category: str, user: dict = Depends(get_current_user)):
    # IDOR FIX: Only allow viewing own progress
    if user_id != user["user_id"]:
        from fastapi import HTTPException
        raise HTTPException(status_code=403, detail="Cannot view other users' progress")
    return await cert_progress(user_id, category)