

// ============================================
// routes/userRoutes.js
'use strict';
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');
const { authenticate, authorize } = require('../middleware/auth');

// Public routes
router.post('/verify-pin', userController.verifyPin);

// Protected routes - require authentication
router.use(authenticate);

// Get routes
router.get('/',authenticate, userController.getAllUsers);
router.get('/stats', authorize('admin', 'manager'), userController.getUserStats);
router.get('/:id', userController.getUserById);
router.get('/:id/activity', userController.getUserActivity);

// Create routes
router.post('/', authorize('admin', 'manager'), userController.createUser);

// Update routes
router.put('/:id', authorize('admin', 'manager'), userController.updateUser);
router.put('/:id/password', userController.updatePassword);
router.patch('/:id/toggle-status', authorize(['admin', 'manager']), userController.toggleUserStatus);

// Delete routes
router.delete('/:id', authorize('admin'), userController.deleteUser);

module.exports = router;
