use axum::Json;
use axum::extract::{Extension, FromRef, Path, State};
use erp_core::rbac::require_permission;
use erp_core::types::{ApiResponse, TenantContext};

use crate::state::AiState;

pub async fn get_patient_risk<S>(
    State(state): State<AiState>,
    Extension(ctx): Extension<TenantContext>,
    Path(patient_id): Path<uuid::Uuid>,
) -> Result<Json<ApiResponse<serde_json::Value>>, erp_core::error::AppError>
where
    AiState: FromRef<S>,
    S: Clone + Send + Sync + 'static,
{
    require_permission(&ctx, "copilot.risk.view")?;

    let risk = crate::service::risk_service::RiskService::compute_risk_with_llm(
        &state.db,
        ctx.tenant_id,
        patient_id,
        &state.provider_registry,
        "ollama",
    )
    .await?;

    Ok(Json(ApiResponse::ok(serde_json::to_value(&risk).map_err(
        |e| erp_core::error::AppError::Internal(e.to_string()),
    )?)))
}