<?php

use App\Http\Controllers\Admin\SharedReportController;
use App\Http\Controllers\Api\DocumentationController;
use App\Http\Controllers\NotificationHubController;
use App\Http\Controllers\ShareLinkController;
use App\Http\Controllers\SignatureController;
use App\Http\Controllers\Webhook\StripeWebhookController;
use Illuminate\Support\Facades\Route;

// Note: Root "/" route is handled by domain-specific route files:
// - scopeforged.com → routes/marketing.php (marketing homepage)
// - portal.scopeforged.com → routes/portal.php (portal dashboard, requires auth)
// - admin.scopeforged.com → routes/admin/dashboard.php (admin dashboard, requires auth)

// Public share link routes
Route::prefix('share')->name('share.')->group(function () {
    Route::get('{token}', [ShareLinkController::class, 'show'])->name('show');
    Route::post('{token}/verify', [ShareLinkController::class, 'verifyPassword'])->name('verify-password');
    Route::get('{token}/download', [ShareLinkController::class, 'download'])->name('download');
    Route::get('{token}/preview', [ShareLinkController::class, 'preview'])->name('preview');
});

// Stripe webhook (CSRF exempt - handled in VerifyCsrfToken middleware)
Route::post('webhooks/stripe', [StripeWebhookController::class, 'handle'])
    ->name('webhooks.stripe')
    ->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);

// Legacy dashboard route - redirect based on role
Route::get('/dashboard', function () {
    if (auth()->user()->isAdmin()) {
        return redirect()->route('admin.dashboard');
    }

    return redirect()->route('portal.dashboard');
})->middleware(['auth', 'verified'])->name('dashboard');

// API Documentation (Swagger UI)
Route::get('/api/docs', [DocumentationController::class, 'ui'])->name('api.docs.ui');

// Document Signing (public routes with token-based authentication)
Route::prefix('sign')->name('documents.sign.')->group(function () {
    Route::get('/{token}', [SignatureController::class, 'show'])->name('show');
    Route::post('/{token}', [SignatureController::class, 'sign'])->name('submit');
    Route::post('/{token}/decline', [SignatureController::class, 'decline'])->name('decline');
    Route::get('/{token}/confirmation', [SignatureController::class, 'confirmation'])->name('confirmation');
    Route::get('/{token}/declined', [SignatureController::class, 'declinedConfirmation'])->name('declined-confirmation');
    Route::get('/{token}/download', [SignatureController::class, 'downloadSignedCopy'])->name('download');
});

// Shared Reports (public routes with token-based authentication)
Route::prefix('r')->name('shared-reports.')->group(function () {
    Route::get('/{token}', [SharedReportController::class, 'view'])->name('view');
    Route::post('/{token}/password', [SharedReportController::class, 'view'])->name('password');
    Route::get('/{token}/download/{format?}', [SharedReportController::class, 'download'])->name('download');
});

// Notification Unsubscribe (public routes with token-based authentication)
Route::prefix('unsubscribe')->name('notifications.unsubscribe.')->group(function () {
    Route::get('/{token}', [NotificationHubController::class, 'unsubscribe'])->name('show');
    Route::post('/{token}', [NotificationHubController::class, 'processUnsubscribe'])->name('process');
});