import { Router } from "express";
import {
  getUsers,
  getUserById,
  createUser,
  updateUser,
  deleteUser
} from "../controllers/usersController.js";
import { requireAuth, requireAdmin } from "../middleware/auth.js";
import { auditMutationLogger } from "../middleware/auditLogger.js";

const router = Router();

// Protect all user routes (only admin can access)
router.use(requireAuth, requireAdmin, auditMutationLogger);

router.get("/", getUsers);
router.get("/:id", getUserById);
router.post("/", createUser);
router.put("/:id", updateUser);
router.delete("/:id", deleteUser);

export default router;
