package in.ac.amu.zhcet.controller.dean;

import in.ac.amu.zhcet.data.model.Department;
import in.ac.amu.zhcet.data.model.FacultyMember;
import in.ac.amu.zhcet.data.model.user.UserAuth;
import in.ac.amu.zhcet.data.type.Roles;
import in.ac.amu.zhcet.service.FacultyService;
import in.ac.amu.zhcet.service.user.UserDetailService;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.mvc.support.RedirectAttributes;

import java.util.HashSet;
import java.util.List;
import java.util.Set;

@Slf4j
@Controller
public class RoleManagementController {

    private final UserDetailService userDetailService;
    private final FacultyService facultyService;

    @Autowired
    public RoleManagementController(UserDetailService userDetailService, FacultyService facultyService) {
        this.userDetailService = userDetailService;
        this.facultyService = facultyService;
    }

    @PreAuthorize("isDepartment(#department)")
    @GetMapping("/dean/roles/{department}")
    public String roleManagement(Model model, @PathVariable Department department) {

        if (department != null) {
            model.addAttribute("page_title", "Role Management");
            model.addAttribute("page_subtitle", "Role Management Panel for " + department.getName() + " Department");
            model.addAttribute("page_description", "Manage Faculty Roles and Permissions");

            model.addAttribute("department", department);
            model.addAttribute("facultyMembers", facultyService.getAllByDepartment(department));
        }

        return "dean/role_management";
    }

    @PreAuthorize("isDepartment(#department)")
    @PostMapping("/dean/roles/{department}")
    public String saveRoles(RedirectAttributes redirectAttributes, @PathVariable Department department, @RequestParam String facultyId, @RequestParam(required = false) List<String> roles) {
        FacultyMember facultyMember = facultyService.getById(facultyId);

        if (facultyMember == null)
            return "redirect:/dean/roles/{department}";

        Set<String> newRoles = new HashSet<>();

        if (roles != null)
        for (String role : roles) {
            switch (role) {
                case "dean":
                    newRoles.add(Roles.DEAN_ADMIN);
                    break;
                case "department_super":
                    newRoles.add(Roles.DEPARTMENT_SUPER_ADMIN);
                    break;
                case "department":
                    newRoles.add(Roles.DEPARTMENT_ADMIN);
                    break;
                case "faculty":
                    newRoles.add(Roles.FACULTY);
                    break;
                default:
                    // Skip
            }
        }

        facultyMember.getUser().setRoles(newRoles);
        facultyService.save(facultyMember);

        UserAuth loggedIn = userDetailService.getLoggedInUser();
        if (facultyMember.getUser().getUserId().equals(loggedIn.getUserId()))
            userDetailService.updatePrincipal(loggedIn);

        redirectAttributes.addFlashAttribute("saved", true);

        return "redirect:/dean/roles/{department}";
    }

}

@@ -465,28 +465,29 @@
 ess.
-prepost.PreAuthorize
+AccessDeniedException
 ;%0Aim
@@ -1351,55 +1351,8 @@
  %7D%0A%0A
-    @PreAuthorize(%22isDepartment(#department)%22)%0A
     
@@ -1476,17 +1476,16 @@
 ment) %7B%0A
-%0A
         
@@ -1503,31 +1503,78 @@
 ent 
-!
+=
 = null)
- %7B
 %0A     
+       throw new AccessDeniedException(%22403%22);%0A%0A
        
+ 
 mode
@@ -1614,36 +1614,32 @@
 e Management%22);%0A
-    
         model.ad
@@ -1736,36 +1736,32 @@
 ment%22);%0A        
-  
-  
 model.addAttribu
@@ -1825,36 +1825,32 @@
 ons%22);%0A%0A        
-    
 model.addAttribu
@@ -1883,28 +1883,24 @@
 t);%0A        
- 
-   
 model.addAtt
@@ -1971,26 +1971,16 @@
 tment));
-%0A        %7D
 %0A%0A      
@@ -2023,55 +2023,8 @@
  %7D%0A%0A
-    @PreAuthorize(%22isDepartment(#department)%22)%0A
     
@@ -2246,32 +2246,117 @@
 tring%3E roles) %7B%0A
+        if (department == null)%0A            throw new AccessDeniedException(%22403%22);%0A%0A
         FacultyM

Allow dean to access all departments for role management