<?php

use App\Http\Controllers\Api\V1\AbsenceController;
use App\Http\Controllers\Api\V1\AcademyController;
use App\Http\Controllers\Api\V1\AppConfigController;
use App\Http\Controllers\Api\V1\AuthOtpController;
use App\Http\Controllers\Api\V1\BranchController;
use App\Http\Controllers\Api\V1\BroadcastController;
use App\Http\Controllers\Api\V1\DashboardController;
use App\Http\Controllers\Api\V1\DeepLinkController;
use App\Http\Controllers\Api\V1\DeviceController;
use App\Http\Controllers\Api\V1\DocumentController;
use App\Http\Controllers\Api\V1\EvaluationController;
use App\Http\Controllers\Api\V1\EventController;
use App\Http\Controllers\Api\V1\InstallmentController;
use App\Http\Controllers\Api\V1\MessageController;
use App\Http\Controllers\Api\V1\NotificationController;
use App\Http\Controllers\Api\V1\OrderController;
use App\Http\Controllers\Api\V1\ParticipantController;
use App\Http\Controllers\Api\V1\PaymentController;
use App\Http\Controllers\Api\V1\ProfileController;
use App\Http\Controllers\Api\V1\PushAnalyticsController;
use App\Http\Controllers\Api\V1\ReceiptController;
use App\Http\Controllers\Api\V1\ServiceRequestController;
use App\Http\Controllers\Api\V1\ShopController;
use App\Http\Controllers\Api\V1\WalletController;
use Illuminate\Support\Facades\Route;

Route::prefix('v1')->middleware('throttle:api')->group(function () {
    // Health check (public, lightweight)
    Route::get('health', fn () => response()->json([
        'status' => 'ok',
        'version' => '1.0',
        'timestamp' => now()->toIso8601String(),
    ]));

    // Public (no auth required)
    Route::get('app/config', [AppConfigController::class, 'index']);

    // Branches (public — for branch locator)
    Route::get('branches', [BranchController::class, 'index']);

    // Auth (stricter rate limit)
    Route::prefix('auth')->middleware('throttle:api-auth')->group(function () {
        Route::post('otp/request', [AuthOtpController::class, 'requestOtp'])->middleware('throttle:api-otp');
        Route::post('otp/verify', [AuthOtpController::class, 'verify']);
        Route::middleware('auth:sanctum')->group(function () {
            Route::post('logout', [AuthOtpController::class, 'logout']);
            Route::get('me', [AuthOtpController::class, 'me']);
        });
    });

    // Public academy content (accessible without login for explore)
    Route::prefix('academy')->group(function () {
        Route::get('news', [AcademyController::class, 'news']);
        Route::get('news/{uuid}', [AcademyController::class, 'newsShow']);
        Route::get('programs', [AcademyController::class, 'programs']);
        Route::get('events', [AcademyController::class, 'events']);
        Route::get('events/{uuid}', [EventController::class, 'show']);
        Route::get('gallery', [AcademyController::class, 'gallery']);
    });

    // Protected endpoints
    Route::middleware('auth:sanctum')->group(function () {
        // Dashboard (single-call home screen)
        Route::get('dashboard', [DashboardController::class, 'index']);

        // Profile
        Route::get('profile', [ProfileController::class, 'show']);
        Route::patch('profile', [ProfileController::class, 'update']);
        Route::post('profile/photo', [ProfileController::class, 'uploadPhoto']);

        // Device token registration
        Route::post('devices/register', [DeviceController::class, 'register']);
        Route::patch('devices/refresh', [DeviceController::class, 'refresh']);
        Route::delete('devices/{token}', [DeviceController::class, 'destroy']);

        // Guardian's children
        Route::get('guardian/children', [ParticipantController::class, 'children']);

        // Participant data
        Route::prefix('participants/{uuid}')->group(function () {
            Route::get('/', [ParticipantController::class, 'show']);
            Route::get('summary', [ParticipantController::class, 'summary']);
            Route::get('schedule', [ParticipantController::class, 'schedule']);
            Route::get('attendance', [ParticipantController::class, 'attendance']);
            Route::get('invoices', [ParticipantController::class, 'invoices']);
            Route::get('enrollments', [ParticipantController::class, 'enrollments']);
            Route::get('documents', [DocumentController::class, 'index']);
            Route::get('wallet', [WalletController::class, 'balance']);
            Route::get('wallet/transactions', [WalletController::class, 'transactions']);
            Route::get('installments', [InstallmentController::class, 'plans']);
            Route::get('evaluations', [EvaluationController::class, 'index']);
            Route::get('evaluations/{evaluationUuid}', [EvaluationController::class, 'show']);
        });

        // Notifications
        Route::get('notifications', [NotificationController::class, 'index']);
        Route::patch('notifications/{id}/read', [NotificationController::class, 'markAsRead']);
        Route::post('notifications/read-all', [NotificationController::class, 'markAllAsRead']);
        Route::get('notifications/preferences', [NotificationController::class, 'getPreferences']);
        Route::post('notifications/preferences', [NotificationController::class, 'updatePreferences']);

        // Shop (essential products)
        Route::get('products', [ShopController::class, 'products']);

        // Orders (product purchases from mobile)
        Route::post('orders/create', [OrderController::class, 'create']);
        Route::get('orders', [OrderController::class, 'index']);

        // Payments (online via Paymob)
        Route::post('payments/initiate', [PaymentController::class, 'initiate'])->middleware('throttle:api-payments');

        // Invoices & Receipts
        Route::get('invoices/{uuid}', [ReceiptController::class, 'invoiceDetail']);
        Route::get('payments/{uuid}/receipt', [ReceiptController::class, 'paymentReceipt']);

        // Events (authenticated actions)
        Route::post('events/{uuid}/register', [EventController::class, 'register']);
        Route::get('events/my-registrations', [EventController::class, 'myRegistrations']);

        // Service requests (freeze, transfer, cancellation)
        Route::post('service-requests', [ServiceRequestController::class, 'create']);
        Route::get('service-requests', [ServiceRequestController::class, 'index']);
        Route::post('service-requests/{uuid}/cancel', [ServiceRequestController::class, 'cancel']);

        // Absence reporting
        Route::post('absences/report', [AbsenceController::class, 'report']);

        // Messages (guardian ↔ academy)
        Route::post('messages/send', [MessageController::class, 'send']);
        Route::get('messages', [MessageController::class, 'index']);

        // Push analytics & badge
        Route::post('push/track', [PushAnalyticsController::class, 'track']);
        Route::get('push/badge', [PushAnalyticsController::class, 'badge']);
        Route::post('push/heartbeat', [PushAnalyticsController::class, 'heartbeat']);

        // Broadcast announcements (admin only)
        Route::post('broadcast/send', [BroadcastController::class, 'send']);
        Route::get('broadcast/history', [BroadcastController::class, 'index']);

        // Deep link routing map
        Route::get('deeplinks/routes', [DeepLinkController::class, 'routes']);
    });

    // Payment gateway webhook (NO auth — Paymob sends server-to-server)
    Route::post('payments/callback', [PaymentController::class, 'callback']);
});
