<?php

/**
 * Auth Routes (Breeze)
 *
 * Note: Primary login/signup/password-reset routes are now on the marketing site.
 *
 * @see routes/marketing.php for login, signup, forgot-password, reset-password
 *
 * This file retains:
 * - Email verification routes
 * - Password confirmation routes
 * - Two-factor authentication routes
 * - Profile password update route
 */

use App\Http\Controllers\Auth\ConfirmablePasswordController;
use App\Http\Controllers\Auth\EmailVerificationNotificationController;
use App\Http\Controllers\Auth\EmailVerificationPromptController;
use App\Http\Controllers\Auth\PasswordController;
use App\Http\Controllers\Auth\TwoFactorChallengeController;
use App\Http\Controllers\Auth\TwoFactorController;
use App\Http\Controllers\Auth\VerifyEmailController;
use Illuminate\Support\Facades\Route;

Route::middleware('auth')->group(function () {
    Route::get('verify-email', EmailVerificationPromptController::class)
        ->name('verification.notice');

    Route::get('verify-email/{id}/{hash}', VerifyEmailController::class)
        ->middleware(['signed', 'throttle:6,1'])
        ->name('verification.verify');

    Route::post('email/verification-notification', [EmailVerificationNotificationController::class, 'store'])
        ->middleware('throttle:6,1')
        ->name('verification.send');

    Route::get('confirm-password', [ConfirmablePasswordController::class, 'show'])
        ->name('password.confirm');

    Route::post('confirm-password', [ConfirmablePasswordController::class, 'store']);

    Route::put('password', [PasswordController::class, 'update'])->name('profile.password.update');

    // Note: logout is handled by Marketing\AuthController on marketing domain
    // @see routes/marketing.php

    // Two-factor authentication settings
    Route::get('two-factor', [TwoFactorController::class, 'show'])
        ->name('two-factor.show');

    Route::post('two-factor/setup', [TwoFactorController::class, 'setup'])
        ->middleware('throttle:sensitive')
        ->name('two-factor.setup');

    Route::post('two-factor/confirm', [TwoFactorController::class, 'confirm'])
        ->middleware('throttle:two-factor')
        ->name('two-factor.confirm');

    Route::delete('two-factor', [TwoFactorController::class, 'disable'])
        ->middleware('throttle:sensitive')
        ->name('two-factor.disable');

    Route::post('two-factor/regenerate-codes', [TwoFactorController::class, 'regenerateCodes'])
        ->middleware('throttle:sensitive')
        ->name('two-factor.regenerate-codes');
});

// Two-factor challenge routes (accessible during 2FA pending login)
Route::middleware('guest')->group(function () {
    Route::get('two-factor-challenge', [TwoFactorChallengeController::class, 'show'])
        ->name('two-factor.challenge');

    Route::post('two-factor-challenge', [TwoFactorChallengeController::class, 'verify'])
        ->middleware('throttle:two-factor')
        ->name('two-factor.verify');
});