<?php

use App\Http\Controllers\Api\AuthController;
use App\Http\Controllers\Api\ExpenseController as ExpenseApiController;
use App\Http\Controllers\ExpenseController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| Web Routes
|--------------------------------------------------------------------------
|
| One HTML page ("/") boots the Vue app; everything the app reads or writes
| goes through the /api endpoints below. Print, CSV and PDF stay
| server-rendered because they are documents, not screens.
|
| The API lives here rather than in routes/api.php so it keeps the web
| session and CSRF protection — the SPA is same-origin, no tokens needed.
|
| Only "/" is public, and only so a guest can be shown the login screen.
| Every route that touches data checks a permission:
|
|   expense.view    দেখা, প্রিন্ট, CSV, PDF   (admin + viewer)
|   expense.create  যোগ করা                   (admin)
|   expense.edit    এডিট                      (admin)
|   expense.delete  ডিলিট                     (admin)
*/

Route::get('/', [ExpenseController::class, 'index'])->name('expenses.index');

Route::post('/api/login', [AuthController::class, 'login'])
    ->middleware('throttle:6,1')     // slows down password guessing
    ->name('api.login');

Route::post('/api/logout', [AuthController::class, 'logout'])
    ->middleware('auth')
    ->name('api.logout');

Route::middleware(['auth', 'can:expense.view'])->group(function () {
    Route::get('/print', [ExpenseController::class, 'print'])->name('expenses.print');
    Route::get('/export', [ExpenseController::class, 'export'])->name('expenses.export');
    Route::get('/report', [ExpenseController::class, 'pdf'])->name('expenses.pdf');
});

Route::prefix('api')->name('api.')->middleware('auth')->group(function () {
    Route::get('/expenses', [ExpenseApiController::class, 'index'])
        ->middleware('can:expense.view')->name('expenses.index');

    Route::post('/expenses', [ExpenseApiController::class, 'store'])
        ->middleware('can:expense.create')->name('expenses.store');

    Route::put('/expenses/{expense}', [ExpenseApiController::class, 'update'])
        ->middleware('can:expense.edit')->name('expenses.update');

    Route::delete('/expenses/{expense}', [ExpenseApiController::class, 'destroy'])
        ->middleware('can:expense.delete')->name('expenses.destroy');
});
