const express = require('express');
const router = express.Router();
const {
  createReservation,
  paytrCallback,
  getAllReservations,
  getReservationById,
  updateReservationStatus,
  checkAvailability
} = require('../controllers/reservationController');
const { protect, adminOnly } = require('../middleware/authMiddleware');
const { paytrWebhookSecurity } = require('../middleware/paytrWebhookSecurity');

// Public routes - ÖNCE SPESIFIK ROUTE'LAR
router.post('/paytr-callback', paytrWebhookSecurity, paytrCallback); // ✅ IP whitelist koruması
router.get('/paytr-callback', (req, res) => res.send('PayTR Callback - Only POST allowed')); // GET için bilgi
router.get('/check-availability', checkAvailability);
router.post('/', createReservation);

// Admin routes - SONRA GENEL ROUTE'LAR
router.get('/', protect, adminOnly, getAllReservations);
router.get('/:id', protect, adminOnly, getReservationById);
router.put('/:id', protect, adminOnly, updateReservationStatus);

module.exports = router;
