<?php

use App\Http\Controllers\Auth\LoginController;
use App\Http\Controllers\Auth\RegisterController;
use App\Http\Controllers\Auth\PasswordResetController;
use App\Http\Controllers\Auth\EmailVerificationController;
use App\Http\Controllers\Auth\SocialAuthController;
use App\Http\Controllers\Auth\OtpController;
use App\Http\Controllers\Auth\TwoFactorController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| Authentication Routes
|--------------------------------------------------------------------------
|
| These routes handle all authentication flows: login, registration,
| password reset, email verification, OTP, 2FA, and social OAuth.
|
*/

// ============================================================================
// GUEST ROUTES (unauthenticated only)
// ============================================================================

Route::middleware('guest')->group(function () {

    // Login
    Route::get('login', [LoginController::class, 'showLoginForm'])->name('login');
    Route::get('login/{role}', [LoginController::class, 'showRoleLoginForm'])->name('login.role');
    Route::post('login', [LoginController::class, 'login'])->name('login.submit');

    // Registration
    Route::get('register', [RegisterController::class, 'showRegistrationForm'])->name('register');
    Route::post('register', [RegisterController::class, 'register'])->name('register.submit');
    Route::get('register/role-fields', [RegisterController::class, 'getRoleFields'])->name('register.role-fields');
    Route::get('register/check-username', [RegisterController::class, 'checkUsername'])->name('register.check-username');
    Route::get('register/check-email', [RegisterController::class, 'checkEmail'])->name('register.check-email');

    // Password Reset
    Route::get('forgot-password', [PasswordResetController::class, 'showLinkRequestForm'])->name('password.request');
    Route::post('forgot-password', [PasswordResetController::class, 'sendResetLinkEmail'])->name('password.email');
    Route::get('reset-password/{token}', [PasswordResetController::class, 'showResetForm'])->name('password.reset');
    Route::post('reset-password', [PasswordResetController::class, 'reset'])->name('password.store');
    Route::get('password/rate-limit', [PasswordResetController::class, 'checkRateLimit'])->name('password.rate-limit');

    // Social OAuth — redirect to provider
    Route::get('auth/{provider}/redirect', [SocialAuthController::class, 'redirectToProvider'])
        ->name('auth.social.redirect');

    // Social registration role selection — MUST be before the dynamic {provider} callback route
    Route::get('auth/social/role-select', [SocialAuthController::class, 'showRoleSelectForm'])
        ->name('auth.social.role-select');

    Route::post('auth/social/complete-registration', [SocialAuthController::class, 'completeRegistration'])
        ->name('auth.social.complete-registration');

    Route::get('auth/{provider}/callback', [SocialAuthController::class, 'handleProviderCallback'])
        ->name('auth.social.callback');
});

// ============================================================================
// AUTHENTICATED ROUTES
// ============================================================================

Route::middleware('auth')->group(function () {

    // Logout
    Route::post('logout', [LoginController::class, 'logout'])->name('logout');

    // Email Verification
    Route::get('verify-email', [EmailVerificationController::class, 'show'])
        ->name('verification.notice');

    Route::get('verify-email/{id}/{hash}', [EmailVerificationController::class, 'verify'])
        ->middleware(['signed', 'throttle:6,1'])
        ->name('verification.verify');

    Route::post('email/verification-notification', [EmailVerificationController::class, 'resend'])
        ->middleware('throttle:6,1')
        ->name('verification.send');

    // Social account management
    Route::delete('auth/social/{provider}/unlink', [SocialAuthController::class, 'unlink'])
        ->name('auth.social.unlink');
});

// ============================================================================
// OTP VERIFICATION ROUTES (mixed — some require session, not full auth)
// ============================================================================

Route::prefix('otp')->name('otp.')->group(function () {
    Route::get('/verify', [OtpController::class, 'showOtpForm'])->name('verify');
    Route::post('/verify', [OtpController::class, 'verify'])->name('verify.submit');
    Route::post('/resend', [OtpController::class, 'resend'])->name('resend');
    Route::get('/cancel', [OtpController::class, 'cancel'])->name('cancel');
});

// ============================================================================
// TWO-FACTOR AUTHENTICATION ROUTES
// ============================================================================

Route::prefix('two-factor')->name('two-factor.')->group(function () {
    // Challenge (pre-auth — user has session but not fully authenticated)
    Route::get('/challenge', [TwoFactorController::class, 'showForm'])->name('challenge');
    Route::post('/challenge', [TwoFactorController::class, 'verify'])->name('challenge.verify');
    Route::post('/cancel', [TwoFactorController::class, 'cancel'])->name('cancel');
});

Route::middleware('auth')->prefix('two-factor')->name('two-factor.')->group(function () {
    // Setup (authenticated users managing their 2FA)
    Route::get('/setup', [TwoFactorController::class, 'showSetupForm'])->name('setup');
    Route::post('/enable', [TwoFactorController::class, 'enable'])->name('enable');
    Route::post('/disable', [TwoFactorController::class, 'disable'])->name('disable');
    Route::post('/recovery-codes', [TwoFactorController::class, 'regenerateCodes'])->name('recovery-codes.regenerate');
});
