/** Supplier payment commands and direct-write readiness enforcement. */
routerAdd("GET", "/api/wfdash/order-payments-capability", (e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  payments.assertSchema(e.app);
  return e.json(200, { version: 3 });
}, $apis.requireSuperuserAuth());

routerAdd("POST", "/api/wfdash/order-payments", (e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  const audit = require(`${__hooks}/audit_log_utils.js`);
  const result = payments.command(e, e.requestInfo().body, audit.log);
  return e.json(200, result);
}, $apis.requireSuperuserAuth());

routerAdd("POST", "/api/wfdash/order-payments-document", (e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  const audit = require(`${__hooks}/audit_log_utils.js`);
  const result = payments.uploadDocument(e, e.requestInfo().body, audit.log);
  return e.json(200, result);
}, $apis.requireSuperuserAuth());

onRecordUpdateRequest((e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  const audit = require(`${__hooks}/audit_log_utils.js`);
  return payments.protectItemUpdate(e, audit.log);
}, "order_items");

onRecordCreateRequest((e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  payments.protectProjection(e.requestInfo());
  return e.next();
}, "order_items");

onRecordCreate((e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  const audit = require(`${__hooks}/audit_log_utils.js`);
  return payments.protectModelCreate(e, audit.log);
}, "order_items");

// Also covers internal hook/model writes. Public API projections are protected
// above; internal payment commands update the request before their item writes.
onRecordUpdate((e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  payments.checkReadiness(e.app, payments.plain(e.record));
  return e.next();
}, "order_items");

// These records are immutable to ordinary record API callers, including an
// admin client. Only the transactional command above may change them.
onRecordCreateRequest((e) => { throw new ForbiddenError("Use the supplier payment command."); }, "supplier_payment_requests");
onRecordUpdateRequest((e) => { throw new ForbiddenError("Use the supplier payment command."); }, "supplier_payment_requests");
onRecordDeleteRequest((e) => { throw new ForbiddenError("Payment history cannot be deleted."); }, "supplier_payment_requests");
onRecordDeleteRequest((e) => {
  const payments = require(`${__hooks}/order_payment_utils.js`);
  payments.protectDeletion(e.app, e.record);
  return e.next();
}, "order_items");