<?php

use App\Http\Controllers\Admin\AnalyticsController;
use App\Http\Controllers\Admin\AppController;
use App\Http\Controllers\Admin\UserController;
use App\Http\Controllers\Auth\AuthController;
use App\Http\Controllers\OAuth\AuthorizedAppController;
use App\Http\Controllers\OAuth\ClientController;
use App\Http\Controllers\OAuth\PersonalAccessTokenController;
use Illuminate\Support\Facades\Route;
use Laravel\Passport\Passport;

// Selector de idioma (es/en/ca), no requiere sesión.
Route::post('/web-api/locale', function () {
    request()->validate(['locale' => 'required|in:es,en,ca']);
    session(['locale' => request('locale')]);

    return response()->noContent();
});

// Endpoints de sesión (guard "web") que consume la SPA para loguearse y
// administrar el servidor OAuth2 (clientes, personal access tokens, apps autorizadas).
Route::prefix('web-api')->group(function () {
    Route::get('/setup-status', [AuthController::class, 'setupStatus']);
    Route::post('/register', [AuthController::class, 'register']);
    Route::post('/login', [AuthController::class, 'login']);

    Route::middleware('auth')->group(function () {
        Route::post('/logout', [AuthController::class, 'logout']);
        Route::get('/me', [AuthController::class, 'me']);
        Route::get('/scopes', fn () => response()->json(Passport::scopes()));

        Route::apiResource('clients', ClientController::class)->except(['show']);

        Route::get('/personal-access-tokens', [PersonalAccessTokenController::class, 'index']);
        Route::post('/personal-access-tokens', [PersonalAccessTokenController::class, 'store']);
        Route::delete('/personal-access-tokens/{tokenId}', [PersonalAccessTokenController::class, 'destroy']);

        Route::get('/authorized-apps', [AuthorizedAppController::class, 'index']);
        Route::delete('/authorized-apps/{tokenId}', [AuthorizedAppController::class, 'destroy']);

        // Panel de administración de usuarios (solo para roles/permisos con "users.*").
        Route::prefix('admin')->group(function () {
            Route::get('/users', [UserController::class, 'index'])->middleware('can:users.view');
            Route::get('/users/trashed', [UserController::class, 'trashed'])->middleware('can:users.view');
            Route::get('/users/pending', [UserController::class, 'pending'])->middleware('can:users.view');
            Route::post('/users', [UserController::class, 'store'])->middleware('can:users.create');
            Route::put('/users/{user}', [UserController::class, 'update'])->middleware('can:users.update');
            Route::delete('/users/{user}', [UserController::class, 'destroy'])->middleware('can:users.delete');
            Route::post('/users/{id}/restore', [UserController::class, 'restore'])->middleware('can:users.update')->whereNumber('id');
            Route::delete('/users/{id}/force', [UserController::class, 'forceDelete'])->middleware('can:users.delete')->whereNumber('id');
            Route::post('/users/{user}/approve', [UserController::class, 'approve'])->middleware('can:users.update');

            // Roles por app (multi-tenant): a qué app y con qué rol puede entrar cada usuario.
            Route::get('/apps', [AppController::class, 'index'])->middleware('can:users.view');
            Route::get('/users/{user}/app-roles', [UserController::class, 'appRoles'])->middleware('can:users.view');
            Route::post('/users/{user}/app-roles', [UserController::class, 'assignAppRole'])->middleware('can:users.update');
            Route::delete('/users/{user}/app-roles/{clientId}/{role}', [UserController::class, 'revokeAppRole'])->middleware('can:users.update');

            // Analíticas de uso: sesiones, logins por app, actividad reciente.
            Route::get('/analytics/summary', [AnalyticsController::class, 'summary'])->middleware('can:users.view');
        });
    });
});

// Laravel/Passport redirige a los invitados no autenticados a route('login'), así que
// necesita una ruta fija (no el wildcard de abajo, que exige un parámetro).
Route::view('/login', 'app')->name('login');

// Todo lo demás (home, register, dashboard, /oauth/authorize cuando hay sesión, etc.)
// lo resuelve el shell de la SPA Vue (Vue Router decide qué pantalla mostrar).
Route::view('/', 'app');
Route::get('/{any}', fn () => view('app'))
    ->where('any', '^(?!web-api|api|oauth|storage|login).*$');