<?php

use App\Http\Controllers\Store\AuthController as StoreAuthController;
use App\Http\Controllers\Store\BasketController as StoreBasketController;
use App\Http\Controllers\Store\BillingAddressController as StoreBillingAddressController;
use App\Http\Controllers\Store\DomainController as StoreDomainController;
use App\Http\Controllers\Store\ProductController as StoreProductController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider and all of them will
| be assigned to the "api" middleware group. Make something great!
|
*/

// Store API Endpoints
Route::prefix('store')->name('api.store.')->middleware(['web', 'track.visitor', 'store.locale.visitor'])->group(function () {
    Route::get('/products/{product}/config-options', [StoreProductController::class, 'getConfigurableOptions'])->name('products.config-options');
    // PRC-259 — expensive routes (full tax+coupon recalc, TLD batch lookup,
    // registrar live API) get a per-route throttle of 20/min on top of the
    // group's 60/min, bounding logged-in DoS via repeated heavy RPC.
    Route::post('/products/{product}/calculate', [StoreProductController::class, 'calculate'])->middleware('throttle:20,1')->name('products.calculate');
    Route::post('/domain/check', [StoreDomainController::class, 'check'])->middleware('throttle:20,1')->name('domain.check');

    // Location API Endpoints - Consolidated
    Route::get('/countries', [StoreAuthController::class, 'getCountries'])->name('countries');
    Route::get('/cities/{country}', [StoreAuthController::class, 'getCities'])->name('cities');

    // PRC-359 — public KB/announcement suggest for the ticket form.
    // No auth (KB is public); abuse contained by throttle.
    Route::get('/kb/suggest', [\App\Http\Controllers\Store\KbSuggestController::class, 'suggest'])
        ->middleware('throttle:60,1')->name('kb.suggest');

    // Basket API Endpoints
    Route::post('/basket/add', [StoreBasketController::class, 'add'])->name('basket.add');
    Route::get('/basket/summary', [StoreBasketController::class, 'summary'])->name('basket.summary');
    Route::put('/basket/{index}', [StoreBasketController::class, 'update'])->where('index', '[0-9]+')->name('basket.update');

    // Bulk Domain Configuration Endpoints
    Route::post('/basket/bulk-nameservers', [StoreBasketController::class, 'saveBulkNameservers'])->name('basket.bulk-nameservers');
    Route::post('/basket/bulk-contacts', [StoreBasketController::class, 'saveBulkContacts'])->name('basket.bulk-contacts');
    Route::get('/basket/default-domain-config', [StoreBasketController::class, 'getDefaultDomainConfig'])->name('basket.default-domain-config');

    // Discount & Coupon API Endpoints
    // PRC-259 — coupon apply triggers full basket recalc; throttle 20/min.
    Route::post('/basket/apply-coupon', [StoreBasketController::class, 'applyCoupon'])->middleware('throttle:20,1')->name('basket.apply-coupon');
    Route::delete('/basket/remove-coupon', [StoreBasketController::class, 'removeCoupon'])->name('basket.remove-coupon');
    Route::get('/basket/discount-info', [StoreBasketController::class, 'getDiscountInfo'])->name('basket.discount-info');

    // Basket item removal (must come after specific routes)
    Route::delete('/basket/{index}', [StoreBasketController::class, 'remove'])->where('index', '[0-9]+')->name('basket.remove');

    // Billing Address API Endpoints
    Route::get('/billing-addresses', [StoreBillingAddressController::class, 'index'])->name('billing-addresses.index');
    Route::get('/billing-addresses/{id}', [StoreBillingAddressController::class, 'show'])->name('billing-addresses.show');
    Route::post('/billing-addresses', [StoreBillingAddressController::class, 'store'])->name('billing-addresses.store');
    Route::put('/billing-addresses/{id}', [StoreBillingAddressController::class, 'update'])->name('billing-addresses.update');
    Route::post('/billing-addresses/{id}/select', [StoreBillingAddressController::class, 'select'])->name('billing-addresses.select');
    Route::delete('/billing-addresses/{id}', [StoreBillingAddressController::class, 'destroy'])->name('billing-addresses.destroy');

    // PRC-259 — TLD batch lookup is the most expensive endpoint; throttle 20/min.
    Route::post('/domain/search', [StoreDomainController::class, 'search'])->middleware('throttle:20,1')->name('domain.search');
    // NOTE: /domain/check is also declared above (line 25). Last definition wins
    // in Laravel routing; both share the 20/min throttle.
    Route::post('/domain/check', [StoreDomainController::class, 'check'])->middleware('throttle:20,1')->name('domain.check');

    // Public (guest-accessible) — basket modal metadata, no PII.
    // Per-TLD registrar extra-field definitions. Returns ['fields' => []]
    // when TLD missing, registrar unknown, or module returns no fields.
    Route::get('/domain-extra-fields', [
        \App\Http\Controllers\Store\Api\DomainExtraFieldsController::class, 'show',
    ])->name('domain-extra-fields');

    // Authenticated store API routes
    Route::middleware('auth:client')->group(function () {
        Route::get('/domain/{domain}/renewal-options', [StoreDomainController::class, 'renewalOptions'])->name('domain.renewal-options');
        // PRC-811 — login'li müşterinin ürüne iliştirilmemiş aktif domainleri
        // (ürün sayfasında "hesabımdaki domainler" seçimi için).
        Route::get('/my-domains', [StoreDomainController::class, 'myDomains'])->name('my-domains');
    });

});
