<?php

use App\Http\Controllers\Web\AttendanceController;
use App\Http\Controllers\Web\AuthController;
use App\Http\Controllers\Web\DashboardController;
use App\Http\Controllers\Web\DeviceController;
use App\Http\Controllers\Web\EmployeeController;
use App\Http\Controllers\Web\InstallController;
use App\Http\Controllers\Web\MaintenanceController;
use App\Http\Controllers\Web\ReportController;
use App\Http\Controllers\Web\TaskController;
use App\Http\Controllers\Web\UserController;
use Illuminate\Support\Facades\Route;

Route::get('/', fn () => redirect()->route('dashboard'));

// Browser-only install wizard (no CLI needed) — always reachable, even before
// the app is "installed"; see App\Http\Middleware\EnsureInstalled.
Route::get('/install', [InstallController::class, 'index'])->name('install.index');
Route::post('/install', [InstallController::class, 'store'])->name('install.store');
Route::post('/install/test-db', [InstallController::class, 'testDb'])->name('install.test-db');

// Token-protected endpoints for external cron pingers (e.g. cron-job.org) on
// hosts with no cron access at all. See App\Http\Controllers\Web\TaskController.
Route::get('/tasks/purge-snapshots', [TaskController::class, 'purgeSnapshots'])->name('tasks.purge-snapshots');
Route::get('/tasks/compute-attendance', [TaskController::class, 'computeAttendance'])->name('tasks.compute-attendance');

Route::middleware('guest')->group(function () {
    Route::get('/login', [AuthController::class, 'showLogin'])->name('login');
    Route::post('/login', [AuthController::class, 'login'])->name('login.attempt');
});

Route::post('/logout', [AuthController::class, 'logout'])->middleware('auth')->name('logout');

Route::middleware('auth')->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index'])->name('dashboard');

    // Manual entry: admin, hr, security (security scoped to own site in the controller).
    Route::middleware('role:admin,hr,security')->group(function () {
        Route::get('/manual-entry', [AttendanceController::class, 'createManual'])->name('attendance.manual-entry');
        Route::post('/manual-entry', [AttendanceController::class, 'storeManual'])->name('attendance.manual-entry.store');
    });

    // Employees, attendance register/corrections, reports: admin + hr only (not security).
    Route::middleware('role:admin,hr')->group(function () {
        Route::resource('employees', EmployeeController::class)->except(['show']);
        Route::get('/employees-import', [EmployeeController::class, 'importForm'])->name('employees.import.form');
        Route::post('/employees-import', [EmployeeController::class, 'import'])->name('employees.import');

        Route::get('/attendance', [AttendanceController::class, 'index'])->name('attendance.index');
        Route::get('/attendance/{event}/correct', [AttendanceController::class, 'correctForm'])->name('attendance.correct');
        Route::post('/attendance/{event}/correct', [AttendanceController::class, 'correctStore'])->name('attendance.correct.store');

        Route::get('/reports/daily', [ReportController::class, 'daily'])->name('reports.daily');
        Route::get('/reports/daily/export', [ReportController::class, 'dailyExport'])->name('reports.daily.export');
    });

    // Devices + user administration: admin only.
    Route::middleware('role:admin')->group(function () {
        Route::get('/devices', [DeviceController::class, 'index'])->name('devices.index');
        Route::resource('users', UserController::class)->except(['show']);

        Route::get('/maintenance', [MaintenanceController::class, 'index'])->name('maintenance.index');
        Route::post('/maintenance/purge-snapshots', [MaintenanceController::class, 'purgeSnapshots'])->name('maintenance.purge-snapshots');
    });
});
