<?php

use App\Http\Controllers\Api\HealthController;
use App\Http\Controllers\Api\V1\ClientProjectController;
use App\Http\Controllers\Api\V1\DestinationController;
use App\Http\Controllers\Api\V1\LeadController;
use App\Http\Controllers\Api\V1\SourceController;
use App\Http\Controllers\Api\V1\TemplateController;
use App\Http\Controllers\ClickUpWebhookController;
use App\Http\Controllers\InboundWebhookController;
use App\Http\Controllers\PublicStatus\StatusController;
use Illuminate\Support\Facades\Route;

Route::prefix('v1')->group(function () {
    Route::get('healthz', HealthController::class)->name('v1.healthz');

    Route::middleware(['api.key'])->group(function () {
        // Reads (admin_read).
        Route::middleware(['api.key:admin_read'])->group(function () {
            Route::get('leads', [LeadController::class, 'index'])->name('v1.leads.index');
            Route::get('leads/{id}', [LeadController::class, 'show'])->name('v1.leads.show');
            Route::get('sources', [SourceController::class, 'index'])->name('v1.sources.index');
            Route::get('client-projects', [ClientProjectController::class, 'index'])->name('v1.client-projects.index');
            Route::get('client-projects/{id}', [ClientProjectController::class, 'show'])->name('v1.client-projects.show');
            Route::get('templates', [TemplateController::class, 'index'])->name('v1.templates.index');
            Route::get('templates/{id}', [TemplateController::class, 'show'])->name('v1.templates.show');
            Route::get('scaffold-runs', [TemplateController::class, 'runs'])->name('v1.scaffold-runs.index');
            Route::get('destinations', [DestinationController::class, 'index'])->name('v1.destinations.index');
            Route::get('destinations/{id}', [DestinationController::class, 'show'])->name('v1.destinations.show');
        });

        // Mutations (admin_write).
        Route::middleware(['api.key:admin_write'])->group(function () {
            Route::post('leads', [LeadController::class, 'store'])->name('v1.leads.store');
            Route::post('leads/{id}/route', [LeadController::class, 'route'])->name('v1.leads.route');
            Route::post('leads/{id}/dismiss', [LeadController::class, 'dismiss'])->name('v1.leads.dismiss');
            Route::post('leads/{id}/scaffold', [TemplateController::class, 'scaffoldFromLead'])->name('v1.leads.scaffold');
            Route::post('client-projects', [ClientProjectController::class, 'store'])->name('v1.client-projects.store');
            Route::patch('client-projects/{id}', [ClientProjectController::class, 'update'])->name('v1.client-projects.update');
            Route::post('client-projects/{id}/sync', [ClientProjectController::class, 'sync'])->name('v1.client-projects.sync');
            Route::post('client-projects/{id}/tokens', [ClientProjectController::class, 'issueToken'])->name('v1.client-projects.issue-token');
            Route::delete('client-projects/{id}/tokens/{tokenId}', [ClientProjectController::class, 'revokeToken'])->name('v1.client-projects.revoke-token');
            Route::post('templates', [TemplateController::class, 'store'])->name('v1.templates.store');
            Route::patch('templates/{id}', [TemplateController::class, 'update'])->name('v1.templates.update');
            Route::delete('templates/{id}', [TemplateController::class, 'destroy'])->name('v1.templates.destroy');
            Route::post('destinations', [DestinationController::class, 'store'])->name('v1.destinations.store');
            Route::patch('destinations/{id}', [DestinationController::class, 'update'])->name('v1.destinations.update');
            Route::delete('destinations/{id}', [DestinationController::class, 'destroy'])->name('v1.destinations.destroy');
        });
    });
});

// Per-source HMAC-signed inbound; no bearer.
Route::post('webhooks/inbound/{workspace_id}/{source_slug}', InboundWebhookController::class)
    ->name('webhooks.inbound');

// Per-workspace ClickUp signed callback; no bearer.
Route::post('webhooks/clickup/{workspace_id}', ClickUpWebhookController::class)
    ->name('webhooks.clickup');

// Public read-only client status board. Token IS the secret.
Route::middleware('demo.rate-limit')->get('public/status/{token}', StatusController::class)
    ->name('public.status');