backbone-mailing 0.4.0

//! MailingTrace REST handlers
//!
//! Generated by metaphor-schema. Do not edit manually.
//!
//! Uses Axum and backbone-core's BackboneCrudHandler for all 12 CRUD endpoints.

use std::collections::HashMap;
use std::sync::Arc;

use axum::Router;
use serde::{Deserialize, Serialize};
use uuid::Uuid;
use chrono::{DateTime, Utc};

// Backbone framework imports
use backbone_core::http::{ApiResponse, BackboneCrudHandler};

// Auth integration (optional)
#[cfg(feature = "auth")]
use backbone_auth::middleware::AuthContext;
#[cfg(feature = "auth")]
use backbone_auth::AuthMiddleware;

// Domain imports
use crate::domain::entity::*;
use crate::application::service::{MailingTraceService, ServiceError};

// DTO imports
use crate::presentation::dto::{CreateMailingTraceDto, UpdateMailingTraceDto, PatchMailingTraceDto, MailingTraceResponseDto};

use crate::domain::state_machine::{trace_statusState, trace_statusStateMachine, trace_statusTransition};

/// Application error type
#[derive(Debug, thiserror::Error)]
pub enum MailingTraceError {
    #[error("Not found: {0}")]
    NotFound(String),
    #[error("Validation error: {0}")]
    Validation(String),
    #[error("Database error: {0}")]
    Database(String),
    #[error("Internal error: {0}")]
    Internal(String),
}

impl From<ServiceError> for MailingTraceError {
    fn from(err: ServiceError) -> Self {
        match err {
            ServiceError::NotFound => Self::NotFound(err.to_string()),
            ServiceError::Validation(ref msg) => Self::Validation(msg.clone()),
            ServiceError::AlreadyExists(ref msg) => Self::Validation(msg.clone()),
            ServiceError::Repository(ref e) => Self::Database(e.to_string()),
            ServiceError::Internal(ref msg) => Self::Internal(msg.clone()),
            ServiceError::Violations(_) => Self::Validation(err.to_string()),
        }
    }
}

impl axum::response::IntoResponse for MailingTraceError {
    fn into_response(self) -> axum::response::Response {
        use axum::http::StatusCode;
        use axum::Json;

        let (status, code) = match &self {
            Self::NotFound(_) => (StatusCode::NOT_FOUND, "MAILINGTRACE_NOT_FOUND"),
            Self::Validation(_) => (StatusCode::BAD_REQUEST, "MAILINGTRACE_VALIDATION_ERROR"),
            Self::Database(_) => (StatusCode::INTERNAL_SERVER_ERROR, "MAILINGTRACE_DATABASE_ERROR"),
            Self::Internal(_) => (StatusCode::INTERNAL_SERVER_ERROR, "MAILINGTRACE_INTERNAL_ERROR"),
        };

        let body = serde_json::json!({
            "success": false,
            "error": code,
            "message": self.to_string(),
        });

        (status, Json(body)).into_response()
    }
}

// =============================================================================
// Route Configuration
// =============================================================================

/// Create Axum router with all 16 Backbone endpoints for MailingTrace.
///
/// # Routes
///
/// | Method | Path | Description |
/// |--------|------|-------------|
/// | GET | /mailing_traces | List with pagination |
/// | POST | /mailing_traces | Create new |
/// | GET | /mailing_traces/:id | Get by ID |
/// | PUT | /mailing_traces/:id | Full update |
/// | PATCH | /mailing_traces/:id | Partial update |
/// | DELETE | /mailing_traces/:id | Soft delete |
/// | POST | /mailing_traces/bulk | Bulk create |
/// | POST | /mailing_traces/upsert | Upsert |
/// | GET | /mailing_traces/trash | List deleted |
/// | POST | /mailing_traces/:id/restore | Restore |
/// | DELETE | /mailing_traces/empty | Empty trash |
/// | GET | /mailing_traces/:id/deleted | Get deleted by ID |
/// | DELETE | /mailing_traces/trash/:id | Permanent delete from trash |
/// | GET | /mailing_traces/count | Count active entities |
/// | GET | /mailing_traces/trash/count | Count deleted entities |
///
/// # Example
///
/// ```text
/// let service = Arc::new(MailingTraceService::with_repository(repository));
/// let router = create_mailing_trace_routes(service);
/// ```
pub fn create_mailing_trace_routes(service: Arc<MailingTraceService>) -> Router {
    BackboneCrudHandler::<MailingTraceService, MailingTrace, CreateMailingTraceDto, UpdateMailingTraceDto, MailingTraceResponseDto>::routes(
        service,
        "/mailing_traces",
    )
}

/// Create Axum router with only the read (GET) endpoints for MailingTrace.
///
/// Safe for public, unauthenticated exposure (e.g., reference data).
/// Mutations must be served separately via `create_mailing_trace_write_routes`,
/// typically wrapped in an auth middleware layer.
pub fn create_mailing_trace_read_routes(service: Arc<MailingTraceService>) -> Router {
    BackboneCrudHandler::<MailingTraceService, MailingTrace, CreateMailingTraceDto, UpdateMailingTraceDto, MailingTraceResponseDto>::read_routes(
        service,
        "/mailing_traces",
    )
}

/// Create Axum router with only the write (mutation) endpoints for MailingTrace.
///
/// These routes must NOT be publicly exposed. Wrap them with an auth
/// middleware before nesting into the application router.
///
/// # This is unguarded generic CRUD, not a validated write path
///
/// These are plain create/update/patch/delete mutations over the entity row —
/// they bypass all business invariants. If the module exposes a validated write
/// service (e.g. a command router over its domain engine), serve THAT instead
/// for any mutation that must respect domain rules.
pub fn create_mailing_trace_write_routes(service: Arc<MailingTraceService>) -> Router {
    BackboneCrudHandler::<MailingTraceService, MailingTrace, CreateMailingTraceDto, UpdateMailingTraceDto, MailingTraceResponseDto>::write_routes(
        service,
        "/mailing_traces",
    )
}

/// Create authenticated routes with auth middleware.
///
/// Requires the `auth` feature flag. The `AuthMiddleware` implementation
/// is responsible for extracting and validating tokens, then providing
/// an `AuthContext` via request extensions.
#[cfg(feature = "auth")]
pub fn create_protected_mailing_trace_routes<A: AuthMiddleware + Send + Sync + 'static>(
    service: Arc<MailingTraceService>,
    auth: Arc<A>,
) -> Router {
    use axum::middleware;
    use axum::response::IntoResponse;

    let auth_layer = auth.clone();
    create_mailing_trace_routes(service)
        .layer(middleware::from_fn(move |mut req: axum::extract::Request, next: axum::middleware::Next| {
            let auth = auth_layer.clone();
            async move {
                let token = req.headers()
                    .get(axum::http::header::AUTHORIZATION)
                    .and_then(|h| h.to_str().ok())
                    .and_then(|raw| raw.strip_prefix("Bearer ").or_else(|| raw.strip_prefix("bearer ")))
                    .unwrap_or("");
                match auth.authenticate(token).await {
                    Ok(ctx) => {
                        req.extensions_mut().insert(ctx);
                        next.run(req).await
                    }
                    Err(_) => {
                        (axum::http::StatusCode::UNAUTHORIZED,
                         axum::Json(serde_json::json!({
                             "success": false,
                             "error": "unauthorized",
                             "message": "Authentication required"
                         }))
                        ).into_response()
                    }
                }
            }
        }))
}

// =============================================================================
// State Transition Handlers
// =============================================================================

/// Execute set_process transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_process
pub async fn set_process_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetProcess.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_process");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_process transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetProcess) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Process".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_pending transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_pending
pub async fn set_pending_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetPending.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_pending");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_pending transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetPending) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Pending".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_sent transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_sent
pub async fn set_sent_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetSent.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_sent");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_sent transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetSent) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Sent".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_opened transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_opened
pub async fn set_opened_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetOpened.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_opened");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_opened transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetOpened) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Open".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_replied transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_replied
pub async fn set_replied_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetReplied.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_replied");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_replied transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetReplied) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Reply".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_bounced transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_bounced
pub async fn set_bounced_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetBounced.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_bounced");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_bounced transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetBounced) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Bounce".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_bounced_sms transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_bounced_sms
pub async fn set_bounced_sms_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetBouncedSms.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_bounced_sms");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_bounced_sms transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetBouncedSms) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Bounce".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_failed transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_failed
pub async fn set_failed_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetFailed.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_failed");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_failed transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetFailed) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Error".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Execute set_canceled transition on a MailingTrace.
///
/// POST /mailing_traces/:id/transitions/set_canceled
pub async fn set_canceled_transition(
    axum::extract::State(service): axum::extract::State<Arc<MailingTraceService>>,
    axum::extract::Path(id): axum::extract::Path<String>,
    #[cfg(feature = "auth")] axum::Extension(auth): axum::Extension<AuthContext>,
) -> impl axum::response::IntoResponse {
    use axum::{http::StatusCode, Json};

    // Get current entity
    let entity = match service.get_by_id(&id).await {
        Ok(Some(e)) => e,
        Ok(None) => return (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    };

    // Check permission (if auth enabled)
    #[cfg(feature = "auth")]
    {
        let allowed_roles = trace_statusTransition::SetCanceled.allowed_roles();
        let has_specific_perm = auth.permissions.iter().any(|p| p == "mailing_trace:transition:set_canceled");
        let has_update_perm = auth.permissions.iter().any(|p| p == "mailing_trace:update");
        if !has_specific_perm && !has_update_perm {
            return (StatusCode::FORBIDDEN, Json(ApiResponse::<MailingTraceResponseDto>::error("Insufficient permissions for set_canceled transition")));
        }
    }

    // Create state machine from entity's actual status and validate transition
    let current_state: trace_statusState = entity.trace_status.to_string().parse()
        .unwrap_or(trace_statusState::default());
    let sm = trace_statusStateMachine::from_state(current_state);
    if !sm.can_transition(trace_statusTransition::SetCanceled) {
        return (StatusCode::BAD_REQUEST, Json(ApiResponse::<MailingTraceResponseDto>::error("Transition not allowed from current state")));
    }

    // Apply transition via partial update
    let mut fields: HashMap<String, serde_json::Value> = HashMap::new();
    fields.insert("trace_status".to_string(), serde_json::Value::String("Cancel".to_string()));

    match service.partial_update(&id, fields).await {
        Ok(Some(updated)) => {
            let response: MailingTraceResponseDto = updated.into();
            (StatusCode::OK, Json(ApiResponse::ok(response)))
        }
        Ok(None) => (StatusCode::NOT_FOUND, Json(ApiResponse::<MailingTraceResponseDto>::not_found("MailingTrace", &id))),
        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, Json(ApiResponse::<MailingTraceResponseDto>::error(e.to_string()))),
    }
}

/// Create routes for state transitions.
pub fn create_mailing_trace_transition_routes(service: Arc<MailingTraceService>) -> Router {
    use axum::routing::post;

    Router::new()
        .route("/mailing_traces/:id/transitions/set_process", post(set_process_transition))
        .route("/mailing_traces/:id/transitions/set_pending", post(set_pending_transition))
        .route("/mailing_traces/:id/transitions/set_sent", post(set_sent_transition))
        .route("/mailing_traces/:id/transitions/set_opened", post(set_opened_transition))
        .route("/mailing_traces/:id/transitions/set_replied", post(set_replied_transition))
        .route("/mailing_traces/:id/transitions/set_bounced", post(set_bounced_transition))
        .route("/mailing_traces/:id/transitions/set_bounced_sms", post(set_bounced_sms_transition))
        .route("/mailing_traces/:id/transitions/set_failed", post(set_failed_transition))
        .route("/mailing_traces/:id/transitions/set_canceled", post(set_canceled_transition))
        .with_state(service)
}