package api

import (
	"net/http"

	"browser.local/platform/dto"
)

// runProtectedRequestInput godoc
// @Summary Read one protected request for the active Run lease
// @Description Returns approved SQL, RCON, or management-program text exactly once to its signed, fenced Run lease. Browser and plugin clients never receive this payload.
// @Tags run-job-channel
// @Accept json
// @Produce json
// @Param body body dto.ProtectedRequestExecutionInputRequest true "Fenced protected request input request"
// @Success 200 {object} dto.ProtectedRequestExecutionInputResponse
// @Failure 400 {object} dto.ErrorResponse
// @Failure 401 {object} dto.ErrorResponse
// @Failure 405 {object} dto.ErrorResponse
// @Router /api/v1/run/jobs/protected-request-input [post]
func (h *coreHandlers) runProtectedRequestInput(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		writeMethodNotAllowed(w, http.MethodPost)
		return
	}
	request, err := decodeJSON[dto.ProtectedRequestExecutionInputRequest](r)
	if err != nil {
		writeDecodeError(w, err)
		return
	}
	input, err := h.core.GetProtectedRequestExecutionInput(request.ToDomain())
	if err != nil {
		writeServiceError(w, err)
		return
	}
	writeJSON(w, http.StatusOK, dto.ProtectedRequestExecutionInputFromDomain(input))
}