<?php

use App\Http\Controllers\Public\HomeController;
use App\Http\Controllers\Public\SubmissionController;
use App\Http\Controllers\Public\RgpdController;
use App\Http\Controllers\Admin\AuthController;
use App\Http\Controllers\Admin\DashboardController;
use App\Http\Controllers\Admin\SubmissionController as AdminSubmissionController;
use App\Http\Controllers\Admin\SnapshotController;
use App\Http\Controllers\Admin\SettingsController;
use App\Http\Middleware\CheckIpBlocked;
use App\Http\Middleware\CheckCampaignActive;
use App\Http\Middleware\CheckRole;
use App\Http\Middleware\ForcePasswordChange;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| Rotas Públicas
|--------------------------------------------------------------------------
*/

Route::middleware([CheckIpBlocked::class])->group(function () {
    Route::get('/', [HomeController::class, 'index'])->name('home');

    Route::middleware([CheckCampaignActive::class])->group(function () {
        Route::get('/formulario/{type}', [SubmissionController::class, 'showForm'])->name('submission.form');
        Route::post('/formulario/{type}', [SubmissionController::class, 'submit'])->name('submission.submit');
    });

    Route::get('/sucesso', [SubmissionController::class, 'success'])->name('submission.success');

    // RGPD
    Route::get('/rgpd', [RgpdController::class, 'show'])->name('rgpd.form');
    Route::post('/rgpd', [RgpdController::class, 'submit'])->name('rgpd.submit');
    Route::get('/rgpd/sucesso', [RgpdController::class, 'success'])->name('rgpd.success');
    Route::get('/legal', [RgpdController::class, 'legal'])->name('legal');
});

Route::get('/bloqueado', [HomeController::class, 'blocked'])->name('blocked');

/*
|--------------------------------------------------------------------------
| Rotas Admin — Auth
|--------------------------------------------------------------------------
*/

Route::prefix('admin')->name('admin.')->group(function () {
    Route::get('login', [AuthController::class, 'showLogin'])->name('login');
    Route::post('login', [AuthController::class, 'login'])->name('login.submit');

    Route::get('2fa', [AuthController::class, 'show2fa'])->name('2fa.show');
    Route::post('2fa', [AuthController::class, 'verify2fa'])->name('2fa.verify');

    Route::post('logout', [AuthController::class, 'logout'])->name('logout');
});

/*
|--------------------------------------------------------------------------
| Rotas Admin — Autenticado
|--------------------------------------------------------------------------
*/

Route::prefix('admin')->name('admin.')->middleware(['auth:admin', ForcePasswordChange::class])->group(function () {

    // Password change
    Route::get('password/change', [AuthController::class, 'showChangePassword'])->name('password.change')->withoutMiddleware(ForcePasswordChange::class);
    Route::post('password/change', [AuthController::class, 'changePassword'])->name('password.change.submit')->withoutMiddleware(ForcePasswordChange::class);

    // 2FA Setup
    Route::get('2fa/setup', [AuthController::class, 'show2faSetup'])->name('2fa.setup');
    Route::post('2fa/setup', [AuthController::class, 'setup2fa'])->name('2fa.setup.submit');
    Route::post('2fa/confirm-totp', [AuthController::class, 'confirm2faTotp'])->name('2fa.confirm.totp');
    Route::post('2fa/disable', [AuthController::class, 'disable2fa'])->name('2fa.disable');

    // Dashboard
    Route::get('/', [DashboardController::class, 'index'])->name('dashboard');

    // Submissões (todos os roles)
    Route::get('submissoes', [AdminSubmissionController::class, 'index'])->name('submissions.index');
    Route::get('submissoes/{submission}', [AdminSubmissionController::class, 'show'])->name('submissions.show');

    // Ações RH/Admin
    Route::middleware([CheckRole::class . ':admin,rh'])->group(function () {
        Route::post('submissoes/{submission}/status', [AdminSubmissionController::class, 'updateStatus'])->name('submissions.status');
        Route::post('submissoes/{submission}/morada', [AdminSubmissionController::class, 'updateMorada'])->name('submissions.morada');
        Route::post('submissoes/marcar-concluidos', [AdminSubmissionController::class, 'markExportedAsConcluded'])->name('submissions.mark-concluded');
        Route::get('submissoes/{submission}/pdf', [AdminSubmissionController::class, 'generatePdf'])->name('submissions.pdf');

        // Snapshot
        Route::get('snapshot', [SnapshotController::class, 'index'])->name('snapshot.index');
        Route::post('snapshot/import', [SnapshotController::class, 'import'])->name('snapshot.import');
        Route::post('snapshot/clear', [SnapshotController::class, 'clear'])->name('snapshot.clear');

        // Exports ERP
        Route::get('export/erp', [AdminSubmissionController::class, 'exportErp'])->name('export.erp');
    });

    // Export Contabilidade (todos)
    Route::get('export/contabilidade', [AdminSubmissionController::class, 'exportContabilidade'])->name('export.contabilidade');

    // Settings (Admin only)
    Route::middleware([CheckRole::class . ':admin'])->group(function () {
        Route::get('configuracoes', [SettingsController::class, 'index'])->name('settings.index');
        Route::post('configuracoes/campanha', [SettingsController::class, 'updateCampaign'])->name('settings.campaign');
        Route::post('configuracoes/bloquear-ip', [SettingsController::class, 'blockIp'])->name('settings.block-ip');
        Route::delete('configuracoes/desbloquear-ip/{blockedIp}', [SettingsController::class, 'unblockIp'])->name('settings.unblock-ip');
        Route::post('configuracoes/utilizador', [SettingsController::class, 'createUser'])->name('settings.create-user');
        Route::post('configuracoes/utilizador/{adminUser}/toggle', [SettingsController::class, 'toggleUser'])->name('settings.toggle-user');
        Route::patch('configuracoes/utilizador/{adminUser}', [SettingsController::class, 'updateUser'])->name('settings.update-user');
        Route::delete('configuracoes/utilizador/{adminUser}', [SettingsController::class, 'deleteUser'])->name('settings.delete-user');
        Route::get('audit-log', [SettingsController::class, 'auditLog'])->name('audit-log');
    });

    // RGPD requests (Admin/RH)
    Route::middleware([CheckRole::class . ':admin,rh'])->group(function () {
        Route::get('rgpd-pedidos', [SettingsController::class, 'rgpdRequests'])->name('rgpd-requests');
        Route::post('rgpd-pedidos/{rgpdRequest}', [SettingsController::class, 'rgpdRequestUpdate'])->name('rgpd-requests.update');
    });
});
