/**
 * Admin API router — admin-dashboard.
 * Mounts all admin sub-routes under /api/admin/*.
 * Every route here requires a verified admin session.
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { adminAuthMiddleware } from '../../middleware/admin-auth'
import { adminStatsRoutes } from './stats'
import { adminTenantsRoutes } from './tenants'
import { adminTenantUsersRoutes } from './tenant-users'
import { adminTenantAuditRoutes } from './tenant-audit'
import { adminTenantRolesRoutes } from './tenant-roles'
import { adminRolesRoutes } from './admin-roles'
import { adminTaxRatesRoutes } from './tax-rates'
import { adminReportsRoutes } from './reports'
import { adminReportsTabRoutes } from './reports-tab'
import { adminAnalyticsTabRoutes } from './analytics-tab'
import { adminReportsExportRoutes } from './reports-export'
import { adminIncidentsRoutes } from './incidents'
import { adminBillingPlansRoutes } from './billing-plans'
import { adminImpersonateRoute } from './impersonate'
import { adminProvisionTenantRoute } from './provision-tenant'

const adminRouter = new Hono<AppEnv>()

adminRouter.use('*', adminAuthMiddleware)

// Platform stats
adminRouter.route('/stats', adminStatsRoutes)

// Tenant management
adminRouter.route('/tenants', adminTenantsRoutes)

// Tenant user management (sub-resource of tenants)
adminRouter.route('/tenants', adminTenantUsersRoutes)

// Tenant audit log (sub-resource of tenants)
adminRouter.route('/tenants', adminTenantAuditRoutes)

// Tenant roles management (sub-resource of tenants)
adminRouter.route('/tenants', adminTenantRolesRoutes)

// Admin-plane RBAC
adminRouter.route('/roles', adminRolesRoutes)

// Tax rates
adminRouter.route('/tax-rates', adminTaxRatesRoutes)

// Reports + analytics (wave-3)
adminRouter.route('/reports', adminReportsRoutes)

// admin-reports-analytics (wave-4 tab routes)
adminRouter.route('/reports-tab', adminReportsTabRoutes)
adminRouter.route('/analytics-tab', adminAnalyticsTabRoutes)
adminRouter.route('/reports-export', adminReportsExportRoutes)

// system-status-page: incident management
adminRouter.route('/incidents', adminIncidentsRoutes)

// billing-plans-management-ui (wave-9 leaf 1)
adminRouter.route('/billing-plans', adminBillingPlansRoutes)

// admin-impersonation: mint impersonation token for tenant
adminRouter.route('/tenants', adminImpersonateRoute)

// admin-tenant-provisioning: create tenant + owner user directly
adminRouter.route('/tenants', adminProvisionTenantRoute)

export { adminRouter }