import cors from 'cors';
import express from 'express';

const app = express();

// Global Middleware
app.use(cors());
app.use(express.json());

// Mock routes for testing
app.get('/api/v1/products', (req, res) => {
  res.json({
    success: true,
    data: [
      { id: '1', name: 'Test Product', price: 99.99 }
    ],
    traceId: req.headers['x-trace-id'] || 'test-trace',
    tenantId: req.headers['x-tenant-id'] || 'test-tenant'
  });
});

app.post('/api/v1/orders', (req, res) => {
  res.json({
    success: true,
    data: {
      orderId: `order-${Date.now()}`
    },
    traceId: req.headers['x-trace-id'] || 'test-trace'
  });
});

// Mock admin routes for RBAC testing
app.get('/api/v1/admin/users', (req, res) => {
  const token = req.headers.authorization;
  if (token === 'Bearer admin-token' || token === 'Bearer manager-token') {
    res.json({
      success: true,
      data: [
        { id: '1', name: 'Admin User' }
      ]
    });
  } else if (token) {
    res.status(403).json({
      success: false,
      message: '权限不足'
    });
  } else {
    res.status(401).json({
      success: false,
      message: '未授权'
    });
  }
});

// Mock users route for hierarchy testing
app.get('/api/v1/users', (req, res) => {
  res.json({
    success: true,
    data: [
      { id: '1', name: 'Test User' }
    ]
  });
});

export { app };
