<?php

declare(strict_types=1);

/** APO-249 — GET /api/v1/administration/users/{userId} */
final class MyronReadUserAction implements MyronAction
{
    public function __construct(private readonly MyronAuthRepository $auth) {}

    public function metadata(): MyronActionMetadata
    {
        return new MyronActionMetadata(
            uri: '/api/v1/administration/users/{userId}',
            method: 'GET',
            domain: 'administration',
            resource: 'user',
            verb: 'read',
            inputSchema: [
                'type' => 'object',
                'properties' => ['userId' => ['type' => 'string']],
                'required' => ['userId'],
            ],
            outputSchema: ['type' => 'object', 'properties' => ['user' => ['type' => 'object']]],
            requiredScope: MyronApiScopes::ADMINISTRATION_READ,
            summary: 'Read one operator user with role and granted scopes.',
            audienceClass: 3,
            snapshotInclude: false,
            exposeToMcp: true
        );
    }

    public function execute(array $input, MyronActionCallerContext $caller): MyronActionResult
    {
        $user = $this->auth->findUserById((string) ($input['userId'] ?? ''));
        if (!is_array($user)) {
            return MyronActionResult::error('not_found', 'User not found.');
        }
        unset($user['password_hash']);
        return MyronActionResult::ok(['user' => $user]);
    }
}
