<?php

use Illuminate\Support\Facades\Route;
use Modules\GuidedTour\Http\Controllers\TourController;
use Modules\GuidedTour\Http\Controllers\MediaController;
use Modules\GuidedTour\Http\Controllers\TourAdminController;

Route::middleware(['web', 'auth'])->prefix('tour')->group(function () {

    // ── Runtime (any authenticated user) ────────────────────────────────
    Route::get('/active.json', [TourController::class, 'active'])->name('guidedtour.active');
    Route::post('/progress',   [TourController::class, 'progress'])->name('guidedtour.progress');

    // Protected media stream — signed URL, short TTL, no range (defeats IDM).
    Route::get('/media/{media}', [MediaController::class, 'stream'])
        ->name('guidedtour.media')
        ->middleware('signed');

    // ── Authoring UI (gated by guidedtour.manage) ───────────────────────
    Route::prefix('admin')->group(function () {
        Route::get('/',                 [TourAdminController::class, 'index'])->name('guidedtour.admin');
        Route::post('/flows',           [TourAdminController::class, 'storeFlow'])->name('guidedtour.admin.flow.store');
        Route::put('/flows/{flow}',     [TourAdminController::class, 'updateFlow'])->name('guidedtour.admin.flow.update');
        Route::delete('/flows/{flow}',  [TourAdminController::class, 'destroyFlow'])->name('guidedtour.admin.flow.destroy');

        Route::post('/steps',           [TourAdminController::class, 'storeStep'])->name('guidedtour.admin.step.store');
        Route::put('/steps/{step}',     [TourAdminController::class, 'updateStep'])->name('guidedtour.admin.step.update');
        Route::delete('/steps/{step}',  [TourAdminController::class, 'destroyStep'])->name('guidedtour.admin.step.destroy');
        Route::post('/steps/reorder',   [TourAdminController::class, 'reorderSteps'])->name('guidedtour.admin.step.reorder');

        Route::post('/media',           [TourAdminController::class, 'uploadMedia'])->name('guidedtour.admin.media.upload');
    });
});
