"""
API routes for the example plugin.

Each route must be secured with require_permission.
"""

from fastapi import APIRouter, Depends

from app.deps import get_current_user, require_permission

router = APIRouter()


@router.get(
    "",
    dependencies=[Depends(require_permission("example:read"))],
)
async def list_items(current_user: dict = Depends(get_current_user)):
    """List all items."""
    return {"items": [], "total": 0}


@router.post(
    "",
    status_code=201,
    dependencies=[Depends(require_permission("example:write"))],
)
async def create_item(current_user: dict = Depends(get_current_user)):
    """Create a new item."""
    return {"status": "created"}


@router.get(
    "/{item_id}",
    dependencies=[Depends(require_permission("example:read"))],
)
async def get_item(item_id: str, current_user: dict = Depends(get_current_user)):
    """Get a single item by ID."""
    return {"id": item_id}


@router.delete(
    "/{item_id}",
    dependencies=[Depends(require_permission("example:write"))],
)
async def delete_item(item_id: str, current_user: dict = Depends(get_current_user)):
    """Delete an item by ID."""
    return {"status": "deleted"}