<?php

use Illuminate\Support\Facades\Route;
use Modules\VrcPortalApi\Http\Controllers\Api\OwnerAuthController;
use Modules\VrcPortalApi\Http\Controllers\Api\OwnerController;
use Modules\VrcPortalApi\Http\Controllers\Api\StaffAuthController;
use Modules\VrcPortalApi\Http\Controllers\Api\StaffController;

/*
|--------------------------------------------------------------------------
| VRC PWA JSON API  (/api/v1/vrc/*)
|--------------------------------------------------------------------------
| Every request first resolves the VRC project DB connection (stateless).
*/
Route::middleware(['vrc-portal.connection'])->group(function () {

    // Public brand/config for the login screens.
    Route::get('/brand', [OwnerController::class, 'brand']);

    /* ───────────────────────── OWNER (car owner) ───────────────────────── */
    Route::prefix('owner')->group(function () {
        // Public auth — phone OTP. Throttled against bombing/brute-force.
        Route::middleware('throttle:6,1')->post('/auth/otp/request', [OwnerAuthController::class, 'otpRequest']);
        Route::middleware('throttle:15,1')->post('/auth/otp/verify', [OwnerAuthController::class, 'otpVerify']);

        Route::middleware('vrc-portal.owner')->group(function () {
            Route::post('/auth/logout', [OwnerAuthController::class, 'logout']);
            Route::get('/me',        [OwnerController::class, 'me']);
            Route::get('/home',      [OwnerController::class, 'home']);
            Route::get('/vehicles',  [OwnerController::class, 'vehicles']);
            Route::get('/vehicles/{id}', [OwnerController::class, 'vehicle'])->where('id', '[0-9]+');
            Route::get('/orders',    [OwnerController::class, 'orders']);
            Route::get('/orders/{id}', [OwnerController::class, 'order'])->where('id', '[0-9]+');
            Route::get('/estimates', [OwnerController::class, 'estimates']);
            Route::post('/estimates/{id}/approve', [OwnerController::class, 'approveEstimate'])->where('id', '[0-9]+');
            Route::post('/estimates/{id}/decline', [OwnerController::class, 'declineEstimate'])->where('id', '[0-9]+');
            Route::get('/invoices',  [OwnerController::class, 'invoices']);
        });
    });

    /* ───────────────────────── STAFF (technician/advisor) ───────────────── */
    Route::prefix('staff')->group(function () {
        Route::middleware('throttle:10,1')->post('/auth/password', [StaffAuthController::class, 'password']);

        Route::middleware('vrc-portal.staff')->group(function () {
            Route::post('/auth/logout', [StaffAuthController::class, 'logout']);
            Route::get('/me',       [StaffController::class, 'me']);
            Route::get('/summary',  [StaffController::class, 'summary']);
            Route::get('/board',    [StaffController::class, 'board']);
            Route::get('/orders/{id}', [StaffController::class, 'order'])->where('id', '[0-9]+');
            Route::post('/orders/{id}/transition', [StaffController::class, 'transition'])->where('id', '[0-9]+');
            Route::post('/orders/{id}/lines/{line}/status', [StaffController::class, 'lineStatus'])
                ->where('id', '[0-9]+')->where('line', '[0-9]+');
            Route::post('/orders/{id}/labor/start', [StaffController::class, 'laborStart'])->where('id', '[0-9]+');
            Route::post('/orders/{id}/labor/stop',  [StaffController::class, 'laborStop'])->where('id', '[0-9]+');
            Route::get('/inspections/{id}', [StaffController::class, 'inspection'])->where('id', '[0-9]+');
            Route::post('/inspections/{id}/results', [StaffController::class, 'saveInspection'])->where('id', '[0-9]+');
        });
    });
});
