<?php

use App\Http\Middleware\EnsureSecurityOnboarded;
use App\Livewire\Audit;
use App\Livewire\Auth;
use App\Livewire\Dashboard;
use App\Livewire\Files;
use App\Livewire\Servers;
use App\Livewire\Services;
use App\Livewire\Settings;
use App\Livewire\System;
use App\Livewire\Versions;
use Illuminate\Support\Facades\Auth as AuthFacade;
use Illuminate\Support\Facades\Route;

Route::middleware('guest')->group(function () {
    Route::get('/login', Auth\Login::class)->name('login');
    Route::get('/two-factor-challenge', Auth\TwoFactorChallenge::class)->name('two-factor.challenge');
});

Route::middleware('auth')->group(function () {
    // Security onboarding — reachable before the panel is unlocked.
    Route::get('/password', Auth\PasswordChange::class)->name('password.change');
    Route::get('/two-factor-setup', Auth\TwoFactorSetup::class)->name('two-factor.setup');

    Route::post('/logout', function () {
        AuthFacade::logout();
        session()->invalidate();
        session()->regenerateToken();

        return redirect()->route('login');
    })->name('logout');

    // The panel — requires completed onboarding (password rotated + 2FA enrolled).
    Route::middleware(EnsureSecurityOnboarded::class)->group(function () {
        Route::get('/', Dashboard::class)->name('dashboard');

        Route::get('/servers', Servers\Index::class)->name('servers.index');
        Route::get('/servers/{server}', Servers\Show::class)->name('servers.show');

        Route::get('/services', Services\Index::class)->name('services.index');
        Route::get('/files', Files\Index::class)->name('files.index');
        Route::get('/audit', Audit\Index::class)->name('audit.index');

        Route::get('/settings', Settings\Index::class)->name('settings');
        Route::get('/versions', Versions\Index::class)->name('versions');
        Route::get('/system', System\Index::class)->name('system');
    });
});