<?php

use Illuminate\Support\Facades\Route;
use Modules\ClinicStaffPortal\Http\Controllers\Api\AuthController;
use Modules\ClinicStaffPortal\Http\Controllers\Api\PushController;
use Modules\ClinicStaffPortal\Http\Controllers\Api\StaffController;

/*
|------------------------------------------------------------------------
| Staff PWA shell (production)
|------------------------------------------------------------------------
| Serves the Vite-built PWA from public/staff-app/index.html for any
| /staff-app/* URL so vue-router history mode survives a reload. Hashed
| static assets in public/staff-app/ are served directly by the web server.
*/
Route::middleware(['web'])->prefix('staff-app')->group(function () {
    Route::get('/{any?}', function () {
        $shell = public_path('staff-app/index.html');
        if (! file_exists($shell)) {
            return response()->view('clinicStaffPortal::staff_pwa_build_notice', [], 200);
        }
        return response()->file($shell, [
            'Content-Type'  => 'text/html; charset=utf-8',
            'Cache-Control' => 'no-store, must-revalidate',
            'Pragma'        => 'no-cache',
            'Expires'       => '0',
        ]);
    })->where('any', '.*');
});

/*
|------------------------------------------------------------------------
| Staff JSON API  (/api/v1/staff/*)
|------------------------------------------------------------------------
*/
Route::prefix('api/v1/staff')->group(function () {

    // PUBLIC auth — throttle to slow brute-force.
    Route::middleware(['throttle:10,1'])->group(function () {
        Route::post('/auth/password', [AuthController::class, 'password']);
        if (AuthController::devEnabled()) {
            Route::post('/auth/dev', [AuthController::class, 'dev']);
        }
    });

    // PUBLIC — PWA fetches the VAPID public key before subscribing.
    Route::get('/push/key', [PushController::class, 'vapidKey']);

    // AUTHED  (Bearer <staff token>)
    Route::middleware(['staff-api.auth'])->group(function () {
        Route::post('/auth/logout', [AuthController::class, 'logout']);

        Route::get('/me',        [StaffController::class, 'me']);
        Route::get('/summary',   [StaffController::class, 'summary']);

        Route::get('/schedule',  [StaffController::class, 'schedule']);
        Route::get('/schedule/counts', [StaffController::class, 'scheduleCounts']);

        // NOTE: New-appointment booking (the Location → Department → Doctor → Slot
        // cascade) relied on VetClinic\Services\AppointmentBookingService, which has
        // no ClinicCore equivalent yet — those routes are intentionally omitted.
        Route::post('/appointments/{id}/status', [StaffController::class, 'updateAppointmentStatus'])
            ->where('id', '[0-9]+');

        // Consultation (SOAP + vitals)
        Route::get('/appointments/{id}/consultation',  [StaffController::class, 'consultation'])->where('id', '[0-9]+');
        Route::post('/appointments/{id}/consultation', [StaffController::class, 'saveConsultation'])->where('id', '[0-9]+');

        // Structured exam findings (objective exam templates)
        Route::get('/appointments/{id}/exam/templates', [StaffController::class, 'examTemplates'])->where('id', '[0-9]+');
        Route::get('/appointments/{id}/exam/findings',  [StaffController::class, 'examFindings'])->where('id', '[0-9]+');
        Route::post('/appointments/{id}/exam/findings', [StaffController::class, 'saveExamFinding'])->where('id', '[0-9]+');

        Route::get('/doctors',    [StaffController::class, 'doctors']);

        // NOTE: Ward board, admissions, care logging, MAR and IV-fluid routes came
        // from the VetAdmission inpatient module, which is not part of the ClinicCore
        // human stack — intentionally omitted until a human inpatient module exists.

        Route::get('/patients',      [StaffController::class, 'patients']);
        Route::get('/patients/{id}', [StaffController::class, 'patient'])->where('id', '[0-9]+');
        Route::get('/patients/{id}/prescriptions', [StaffController::class, 'patientPrescriptions'])->where('id', '[0-9]+');
        Route::get('/patients/{id}/lab-sessions', [StaffController::class, 'patientLabSessions'])->where('id', '[0-9]+');
        Route::get('/lab-sessions/{id}', [StaffController::class, 'labSession'])->where('id', '[0-9]+');

        // Lab ordering (LabCore worklist)
        Route::get('/lab/devices', [StaffController::class, 'labDevices']);
        Route::get('/patients/{id}/lab-worklist', [StaffController::class, 'patientLabWorklist'])->where('id', '[0-9]+');
        Route::post('/patients/{id}/lab-orders', [StaffController::class, 'orderLab'])->where('id', '[0-9]+');

        // Vaccinations
        Route::get('/vaccine-types', [StaffController::class, 'vaccineTypes']);
        Route::post('/patients/{id}/vaccinations', [StaffController::class, 'recordVaccination'])->where('id', '[0-9]+');

        // Prescriptions
        Route::get('/medicines',     [StaffController::class, 'medicines']);
        Route::post('/prescriptions',[StaffController::class, 'createPrescription']);
        // Dispensing (FEFO batch → ERP stock decrement)
        Route::get('/prescription-items/{id}/dispense-options', [StaffController::class, 'dispenseOptions'])->where('id', '[0-9]+');
        Route::post('/prescription-items/{id}/dispense',        [StaffController::class, 'dispenseItem'])->where('id', '[0-9]+');

        // NOTE: Ward alerts and AI voice-dictation routes depended on VetAdmission
        // and VetAI respectively — omitted from the ClinicCore human stack.

        // Push subscription management
        Route::post('/push/subscribe',     [PushController::class, 'subscribe']);
        Route::patch('/push/preferences',  [PushController::class, 'preferences']);
        Route::delete('/push/unsubscribe', [PushController::class, 'unsubscribe']);
    });
});
