Hy2026/backend/Controllers/UsersController.cs

using Asp.Versioning;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using TarninaHub.Application.Abstractions;
using TarninaHub.Application.Dtos;
using TarninaHub.Application.Mappings;
using TarninaHub.Application.Security;

namespace TarninaHub.Controllers;

[ApiController]
[ApiVersion("1.0")]
[Route("api/users")]
[Authorize]
public class UsersController : ControllerBase
{
    private readonly IUserService _userService;
    private readonly IAuditLogService _auditLogService;

    public UsersController(IUserService userService, IAuditLogService auditLogService)
    {
        _userService = userService;
        _auditLogService = auditLogService;
    }

    [HttpGet("me")]
    public async Task<ActionResult<UserResponse>> GetMe(CancellationToken cancellationToken)
    {
        var userId = User.GetUserId();

        if (string.IsNullOrWhiteSpace(userId))
        {
            return Unauthorized();
        }

        var user = await _userService.GetByIdAsync(userId, cancellationToken);

        return user is null ? NotFound() : Ok(user.ToResponse());
    }

    [HttpGet("{userId}")]
    public async Task<ActionResult<UserResponse>> GetById(
        string userId,
        CancellationToken cancellationToken)
    {
        var currentUserId = User.GetUserId();
        var isOwner = string.Equals(currentUserId, userId, StringComparison.Ordinal);

        if (!isOwner && !User.IsInRole(RoleNames.Operator) && !User.IsInRole(RoleNames.Manager) && !User.IsInRole(RoleNames.Admin))
        {
            return Forbid();
        }

        var user = await _userService.GetByIdAsync(userId, cancellationToken);

        if (user is null)
        {
            return NotFound();
        }

        if (!isOwner)
        {
            await _auditLogService.RecordAsync(
                currentUserId,
                "user.read",
                userId,
                new Dictionary<string, string?> { ["reason"] = "staff-lookup" },
                cancellationToken);
        }

        return Ok(user.ToResponse());
    }
}