<?php

declare(strict_types=1);

use Builder\Core\Http\Controllers\Account\ConfirmMfaController;
use Builder\Core\Http\Controllers\Account\EnableMfaController;
use Builder\Core\Http\Controllers\Account\RegenerateMfaCodesController;
use Builder\Core\Http\Controllers\Account\ShowAccountController;
use Builder\Core\Http\Controllers\Account\UpdateAccountController;
use Builder\Core\Http\Controllers\Auth\LogoutController;
use Builder\Core\Http\Controllers\Auth\ShowInviteController;
use Builder\Core\Http\Controllers\Auth\ShowLoginController;
use Builder\Core\Http\Controllers\Auth\ShowMfaChallengeController;
use Builder\Core\Http\Controllers\Auth\StoreInviteController;
use Builder\Core\Http\Controllers\Auth\StoreLoginController;
use Builder\Core\Http\Controllers\Auth\StoreMfaChallengeController;
use Builder\Core\Http\Controllers\Dashboard\HideWidgetController;
use Builder\Core\Http\Controllers\Dashboard\ShowWidgetController;
use Builder\Core\Http\Controllers\DashboardController;
use Builder\Core\Http\Controllers\GlobalSearchController;
use Builder\Core\Http\Controllers\HealthController;
use Builder\Core\Http\Controllers\ModuleManifestController;
use Builder\Core\Http\Controllers\Resource\ResourceBulkController;
use Builder\Core\Http\Controllers\Resource\ResourceCreateController;
use Builder\Core\Http\Controllers\Resource\ResourceDestroyController;
use Builder\Core\Http\Controllers\Resource\ResourceDuplicateController;
use Builder\Core\Http\Controllers\Resource\ResourceEditController;
use Builder\Core\Http\Controllers\Resource\ResourceExportController;
use Builder\Core\Http\Controllers\Resource\ResourceIndexController;
use Builder\Core\Http\Controllers\Resource\ResourceOptionsController;
use Builder\Core\Http\Controllers\Resource\ResourceQuickMetaController;
use Builder\Core\Http\Controllers\Resource\ResourceQuickStoreController;
use Builder\Core\Http\Controllers\Resource\ResourceRecordActionController;
use Builder\Core\Http\Controllers\Resource\ResourceRevisionIndexController;
use Builder\Core\Http\Controllers\Resource\ResourceRevisionRestoreController;
use Builder\Core\Http\Controllers\Resource\ResourceStoreController;
use Builder\Core\Http\Controllers\Resource\ResourceUpdateController;
use Builder\Core\Http\Controllers\Settings\ShowSettingsController;
use Builder\Core\Http\Controllers\Settings\UpdateSettingsController;
use Illuminate\Support\Facades\Route;

Route::middleware([
    ...config('builder.middleware', ['web']),
    'builder.locale',
    'builder.inertia',
])
    ->prefix(config('builder.prefix', 'admin'))
    ->name('builder.')
    ->group(function (): void {
        Route::get('/modules/manifest.json', ModuleManifestController::class)->name('modules.manifest');

        Route::get('/login', ShowLoginController::class)->name('login');
        Route::post('/login', StoreLoginController::class)->middleware('throttle:builder-login')->name('login.store');
        Route::post('/logout', LogoutController::class)->name('logout');

        // Invite acceptance (no auth required)
        Route::get('/invite/{token}', ShowInviteController::class)->name('invite.show');
        Route::post('/invite/{token}', StoreInviteController::class)->middleware('throttle:builder-login')->name('invite.store');

        // MFA challenge (after login, before dashboard — builder.auth but NOT builder.mfa)
        Route::middleware(['builder.auth'])->group(function (): void {
            Route::get('/mfa/challenge', ShowMfaChallengeController::class)->name('mfa.challenge');
            Route::post('/mfa/challenge', StoreMfaChallengeController::class)->middleware('throttle:builder-login')->name('mfa.challenge.store');
        });

        // Authenticated routes with full MFA enforcement
        Route::middleware(['builder.auth', 'builder.mfa', 'throttle:builder-global'])->group(function (): void {
            Route::get('/', fn () => to_route('builder.dashboard'))->name('home');
            Route::get('/dashboard', DashboardController::class)->name('dashboard');
            Route::post('/dashboard/widgets/{key}/hide', HideWidgetController::class)->name('dashboard.widget.hide');
            Route::post('/dashboard/widgets/{key}/show', ShowWidgetController::class)->name('dashboard.widget.show');

            // Account
            Route::get('/account', ShowAccountController::class)->name('account.show');
            Route::put('/account', UpdateAccountController::class)->name('account.update');
            Route::post('/account/mfa/enable', EnableMfaController::class)->name('account.mfa.enable');
            Route::post('/account/mfa/confirm', ConfirmMfaController::class)->name('account.mfa.confirm');
            Route::post('/account/mfa/recovery-codes', RegenerateMfaCodesController::class)->name('account.mfa.recovery-codes');

            // Settings pages (sub-page routes must come first to avoid conflict with {page} catch-all)
            Route::get('/settings/{parent}/{page}', ShowSettingsController::class)->name('settings.show.sub');
            Route::put('/settings/{parent}/{page}', UpdateSettingsController::class)->name('settings.update.sub');
            Route::get('/settings/{page}', ShowSettingsController::class)->name('settings.show');
            Route::put('/settings/{page}', UpdateSettingsController::class)->name('settings.update');

            // Application health
            Route::get('/health', HealthController::class)->name('health');

            // Global search
            Route::get('/search', GlobalSearchController::class)->name('search');

            Route::group(['where' => ['resource' => '[a-z][a-z0-9-]+']], function (): void {
                Route::get('/{resource}/create', ResourceCreateController::class)->name('resource.create');
                Route::get('/{resource}/export', ResourceExportController::class)->name('resource.export');
                Route::get('/{resource}/options', ResourceOptionsController::class)->name('resource.options');
                Route::get('/{resource}/quick-create-meta', ResourceQuickMetaController::class)->name('resource.quick-create-meta');
                Route::post('/{resource}/bulk', ResourceBulkController::class)->name('resource.bulk');
                Route::post('/{resource}/quick-store', ResourceQuickStoreController::class)->name('resource.quick-store');
                Route::get('/{resource}/{id}/revisions', ResourceRevisionIndexController::class)->name('resource.revisions');
                Route::post('/{resource}/{id}/revisions/{revision}/restore', ResourceRevisionRestoreController::class)->name('resource.revisions.restore');
                Route::get('/{resource}/{id}/edit', ResourceEditController::class)->name('resource.edit');
                Route::put('/{resource}/{id}', ResourceUpdateController::class)->name('resource.update');
                Route::delete('/{resource}/{id}', ResourceDestroyController::class)->name('resource.destroy');
                Route::post('/{resource}/{id}/action/{action}', ResourceRecordActionController::class)->name('resource.record-action');
                Route::post('/{resource}/{id}/duplicate', ResourceDuplicateController::class)->name('resource.duplicate');
                // Index and store must come last — the greedy {resource} constraint would
                // otherwise swallow paths like /pages/create before the create route matches.
                Route::get('/{resource}', ResourceIndexController::class)->name('resource.index');
                Route::post('/{resource}', ResourceStoreController::class)->name('resource.store');
            });
        });
    });
