<?php

use App\Http\Controllers\ImpersonationController;
use App\Http\Controllers\StripeWebhookController;
use App\Livewire\Admin;
use App\Livewire\Billing;
use App\Livewire\Auth\Login;
use App\Livewire\Auth\TwoFactorChallenge;
use App\Livewire\Backups;
use App\Livewire\Cloud;
use App\Livewire\Dashboard;
use App\Livewire\Invoices;
use App\Livewire\Support;
use App\Livewire\Users;
use Illuminate\Support\Facades\Route;

Route::get('/', fn () => view('landing'))->name('home');

// Generated, not a static file: while the site is hidden this has to say so,
// and a crawler that gets a 404 here simply crawls anyway.
Route::get('/robots.txt', function () {
    $body = App\Support\Settings::bool('site.public', true)
        ? "User-agent: *\nAllow: /\n"
        : "User-agent: *\nDisallow: /\n";

    return response($body, 200, ['Content-Type' => 'text/plain']);
})->name('robots');

// Stripe webhook — paid order → customer provisioning run (CSRF-exempt, signed).
Route::post('/webhooks/stripe', StripeWebhookController::class)->name('webhooks.stripe');

// Public legal pages (placeholders — replace with real content before launch).
Route::prefix('legal')->name('legal.')->group(function () {
    Route::get('/impressum', fn () => view('legal', ['title' => 'Impressum']))->name('impressum');
    Route::get('/datenschutz', fn () => view('legal', ['title' => 'Datenschutz']))->name('datenschutz');
    Route::get('/agb', fn () => view('legal', ['title' => 'AGB']))->name('agb');
    Route::get('/status', fn () => view('legal', ['title' => 'Status']))->name('status');
});

// Guest auth pages — full-page class-based Livewire components (R1/R2). Fortify
// handles the POST actions (login.store, two-factor.login.store) with views off.
Route::middleware('guest')->group(function () {
    Route::get('/login', Login::class)->name('login');
    Route::get('/register', \App\Livewire\Auth\Register::class)->name('register');
    // Registration POST goes through Fortify's controller but with our own
    // registration-scoped throttle (Fortify's built-in route has no limiter).
    Route::post('/register', [\Laravel\Fortify\Http\Controllers\RegisteredUserController::class, 'store'])
        ->middleware('throttle:registration')
        ->name('register.store');
    Route::get('/two-factor-challenge', TwoFactorChallenge::class)->name('two-factor.login');
});

// Customer portal — each sidebar tab is a full-page class-based Livewire
// component (R1/R2); paths are English (R13).
Route::middleware(['auth', 'customer.active'])->group(function () {
    Route::get('/dashboard', Dashboard::class)->name('dashboard');
    Route::get('/cloud', Cloud::class)->name('cloud');
    Route::get('/users', Users::class)->name('users');
    Route::get('/backups', Backups::class)->name('backups');
    Route::get('/invoices', Invoices::class)->name('invoices');
    Route::get('/billing', Billing::class)->name('billing');
    Route::get('/settings', \App\Livewire\Settings::class)->name('settings');
    Route::get('/support', Support::class)->name('support');

    // Return from an admin impersonation session (accessible as the customer user).
    // POST so Laravel's CSRF middleware protects the identity change.
    Route::post('/impersonate/leave', [ImpersonationController::class, 'leave'])->name('impersonate.leave');
});

// Admin / operator console — dark theme, gated to is_admin users (R1/R2, R13).
// RestrictAdminHost is BOTH prepended to the `web` group (deterministic 404 on
// direct hits, even for guests) AND listed here so Livewire records it on the
// component snapshot and re-applies it to /livewire/update requests — otherwise
// admin actions could be invoked through a public hostname.
Route::middleware(['admin.host', 'auth', 'admin'])->prefix('admin')->name('admin.')->group(function () {
    Route::get('/', Admin\Overview::class)->name('overview');
    Route::get('/customers', Admin\Customers::class)->name('customers');
    Route::get('/instances', Admin\Instances::class)->name('instances');
    Route::get('/hosts', Admin\Hosts::class)->name('hosts');
    Route::get('/hosts/create', Admin\HostCreate::class)->name('hosts.create');
    Route::get('/hosts/{host}', Admin\HostDetail::class)->name('hosts.show');
    Route::get('/datacenters', Admin\Datacenters::class)->name('datacenters');
    Route::get('/plans', Admin\Plans::class)->name('plans');
    Route::get('/plans/{uuid}', Admin\PlanVersions::class)->name('plans.versions');
    // POST so the identity change is CSRF-protected (a GET could be forced cross-site).
    Route::post('/impersonate/{customer}', [ImpersonationController::class, 'start'])->name('impersonate');
    Route::get('/provisioning', Admin\Provisioning::class)->name('provisioning');
    Route::get('/maintenance', Admin\Maintenance::class)->name('maintenance');
    Route::get('/vpn', Admin\Vpn::class)->name('vpn');
    Route::get('/revenue', Admin\Revenue::class)->name('revenue');
    Route::get('/settings', Admin\Settings::class)->name('settings');
});