<?php

use Illuminate\Support\Facades\Route;
use Modules\MedDocuments\Http\Controllers\AccessAuditController;
use Modules\MedDocuments\Http\Controllers\DocumentController;
use Modules\MedDocuments\Http\Controllers\DocTypeController;
use Modules\MedDocuments\Http\Controllers\FileController;
use Modules\MedDocuments\Http\Controllers\InstallController;
use Modules\MedDocuments\Http\Controllers\PublicShareController;
use Modules\MedDocuments\Http\Controllers\ShareController;

/*
|--------------------------------------------------------------------------
| MedDocuments — install / update / repair (superadmin-gated in controller)
|--------------------------------------------------------------------------
| The install gate is the LOWERCASE `meddocuments_version` System property —
| the exact key the core's ModuleUtil::isModuleInstalled() reads.
*/
Route::middleware(['web', 'auth'])->prefix('med-docs')->group(function () {
    Route::get('/install', [InstallController::class, 'index']);
    Route::post('/install', [InstallController::class, 'install']);
    Route::get('/uninstall', [InstallController::class, 'uninstall']);
    Route::get('/update', [InstallController::class, 'update']);
    Route::get('/repair', [InstallController::class, 'repair']);
});

/*
|--------------------------------------------------------------------------
| MedDocuments back-office (Blade, inside the ERP UI)
|--------------------------------------------------------------------------
| Session-authenticated routes rendered with the ERP master layout — the same
| middleware stack as the Vrc module (minus the Vrc-only 2fa gate). All routes
| are prefixed `med-docs/` and named `meddoc.*` and guarded by `meddoc.*`
| permissions inside the controllers. ALL file access (view/download/print)
| flows through these controller routes only — there are no public file paths.
*/
Route::middleware(['web', 'auth', 'SetSessionData', 'language', 'timezone', 'AdminSidebarMenu', 'module:MedDocuments'])
    ->prefix('med-docs')
    ->name('meddoc.')
    ->group(function () {
        Route::get('/', [DocumentController::class, 'index'])->name('documents.index');

        // Document browser (DataTable + modals)
        Route::get('documents/data', [DocumentController::class, 'data'])->name('documents.data'); // JSON DataTable
        Route::get('documents/create', [DocumentController::class, 'create'])->name('documents.create'); // upload modal
        Route::post('documents', [DocumentController::class, 'store'])->name('documents.store');
        Route::get('documents/{id}', [DocumentController::class, 'show'])->name('documents.show');
        Route::get('documents/{id}/versions', [DocumentController::class, 'versions'])->name('documents.versions'); // version-history modal
        Route::get('documents/{id}/add-version', [DocumentController::class, 'addVersionForm'])->name('documents.add-version-form');
        Route::post('documents/{id}/versions', [DocumentController::class, 'addVersion'])->name('documents.add-version');
        Route::put('documents/{id}', [DocumentController::class, 'update'])->name('documents.update');
        Route::delete('documents/{id}', [DocumentController::class, 'destroy'])->name('documents.destroy');
        Route::post('documents/{id}/archive', [DocumentController::class, 'archive'])->name('documents.archive');

        // File access — ALL via controller (watermarked view / print + audited download)
        Route::get('documents/{id}/view', [FileController::class, 'view'])->name('documents.view');        // watermarked inline
        Route::get('documents/{id}/print', [FileController::class, 'printView'])->name('documents.print'); // watermarked print page
        Route::get('documents/{id}/download', [FileController::class, 'download'])->name('documents.download');            // watermarked download
        Route::get('documents/{id}/download-original', [FileController::class, 'downloadOriginal'])->name('documents.download-original'); // raw (perm-gated)

        // Share links
        Route::get('documents/{id}/share', [ShareController::class, 'form'])->name('shares.form'); // share-link modal
        Route::post('documents/{id}/share', [ShareController::class, 'store'])->name('shares.store');
        Route::post('shares/{id}/revoke', [ShareController::class, 'revoke'])->name('shares.revoke');

        // Doc types CRUD (system rows read-only)
        Route::get('types/data', [DocTypeController::class, 'data'])->name('types.data');
        Route::resource('types', DocTypeController::class)
            ->parameters(['types' => 'id'])
            ->only(['index', 'create', 'store', 'edit', 'update', 'destroy']);

        // Access audit
        Route::get('audit', [AccessAuditController::class, 'index'])->name('audit.index');
        Route::get('audit/data', [AccessAuditController::class, 'data'])->name('audit.data');
    });

/*
|--------------------------------------------------------------------------
| Public share route — tokenized document access (no login, spec §8)
|--------------------------------------------------------------------------
| Rate-limited; the token is the only credential. Expiry + revocation are
| checked, the access is logged to meddoc_access_logs, and only a WATERMARKED
| view is served (never a raw download).
*/
Route::middleware(['web', 'throttle:30,1'])
    ->prefix('med-docs/shared')
    ->name('meddoc.shared.')
    ->group(function () {
        Route::get('{token}', [PublicShareController::class, 'show'])->name('show');
        Route::get('{token}/view', [PublicShareController::class, 'view'])->name('view'); // watermarked inline stream
    });
