<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\AuthController;
use App\Http\Controllers\DashboardController;
use App\Http\Controllers\LeadController;
use App\Http\Controllers\ContactController;
use App\Http\Controllers\ContractController;
use App\Http\Controllers\CalendarController;
use App\Http\Controllers\CheckMeasureController;
use App\Http\Controllers\CompletionController;
use App\Http\Controllers\CommercialAccountController;
use App\Http\Controllers\JobController;
use App\Http\Controllers\WorksOrderController;
use App\Http\Controllers\PurchaseOrderController;
use App\Http\Controllers\StockController;
use App\Http\Controllers\QuoteController;
use App\Http\Controllers\AppointmentController;
use App\Http\Controllers\FollowUpController;
use App\Http\Controllers\SettingController;
use App\Http\Controllers\UserController;
use App\Http\Controllers\RoleController;
use App\Http\Controllers\ReportController;
use App\Http\Controllers\TimeEntryController;
use App\Http\Controllers\StaffInvoiceController;
use App\Http\Controllers\NotificationController;
use App\Http\Controllers\ShowroomController;

/*
|--------------------------------------------------------------------------
| Web Routes — inz Kitchens CRM
|--------------------------------------------------------------------------
|
| All protected routes use the 'permission' middleware which dynamically
| checks the role_permissions table for the authenticated user's role.
|
| Middleware alias 'permission' is registered in:
|   Laravel 11 → bootstrap/app.php  (included in this zip)
|   Laravel 10 → app/Http/Kernel.php → add to $routeMiddleware:
|                'permission' => \App\Http\Middleware\CheckPermission::class,
|
| Permission naming: <module>.<action>
|   e.g. 'leads.view', 'jobs.create', 'contacts.edit', 'settings.delete'
|
| Admin role bypasses ALL permission checks automatically.
|
*/

// ─── Public Auth Routes ───────────────────────────────────────────────────────
Route::middleware('guest')->group(function () {
    Route::get('/login',  [AuthController::class, 'showLogin'])->name('login');
    Route::post('/login', [AuthController::class, 'login'])->name('login.post');
});
Route::post('/logout', [AuthController::class, 'logout'])->name('logout')->middleware('auth');

// ─── Authenticated Routes ─────────────────────────────────────────────────────
Route::middleware(['auth'])->group(function () {

    // Dashboard — all authenticated users (no specific permission required)
    Route::get('/',          [DashboardController::class, 'index'])->name('dashboard');
    Route::get('/dashboard', [DashboardController::class, 'index'])->name('dashboard.index');

    // ── Notifications ─────────────────────────────────────────────────────────
    Route::get('/notifications',            [NotificationController::class, 'index'])->name('notifications.index');
    Route::post('/notifications/{id}/read', [NotificationController::class, 'markRead'])->name('notifications.read');
    Route::post('/notifications/read-all',  [NotificationController::class, 'markAllRead'])->name('notifications.readAll');

    // ─────────────────────────────────────────────────────────────────────────
    // LEADS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/leads',              [LeadController::class, 'index']) ->name('leads.index')  ->middleware('permission:leads.view');
    Route::get('/leads/create',       [LeadController::class, 'create'])->name('leads.create') ->middleware('permission:leads.create');
    Route::post('/leads',             [LeadController::class, 'store']) ->name('leads.store')  ->middleware('permission:leads.create');
    Route::get('/leads/{lead}',       [LeadController::class, 'show'])  ->name('leads.show')   ->middleware('permission:leads.view');
    Route::get('/leads/{lead}/edit',  [LeadController::class, 'edit'])  ->name('leads.edit')   ->middleware('permission:leads.edit');
    Route::put('/leads/{lead}',       [LeadController::class, 'update'])->name('leads.update') ->middleware('permission:leads.edit');
    Route::patch('/leads/{lead}',     [LeadController::class, 'update'])->name('leads.patch')  ->middleware('permission:leads.edit');
    Route::delete('/leads/{lead}',    [LeadController::class, 'destroy'])->name('leads.destroy')->middleware('permission:leads.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // CONTACTS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/contacts',                [ContactController::class, 'index'])      ->name('contacts.index')        ->middleware('permission:contacts.view');
    Route::get('/contacts/create',         [ContactController::class, 'create'])     ->name('contacts.create')       ->middleware('permission:contacts.create');
    Route::post('/contacts',               [ContactController::class, 'store'])      ->name('contacts.store')        ->middleware('permission:contacts.create');
    Route::get('/contacts/import',         [ContactController::class, 'import'])     ->name('contacts.import')       ->middleware('permission:contacts.create');
    Route::post('/contacts/import',        [ContactController::class, 'importStore'])->name('contacts.import.store') ->middleware('permission:contacts.create');
    Route::get('/contacts/{contact}',      [ContactController::class, 'show'])       ->name('contacts.show')         ->middleware('permission:contacts.view');
    Route::get('/contacts/{contact}/edit', [ContactController::class, 'edit'])       ->name('contacts.edit')         ->middleware('permission:contacts.edit');
    Route::put('/contacts/{contact}',      [ContactController::class, 'update'])     ->name('contacts.update')       ->middleware('permission:contacts.edit');
    Route::patch('/contacts/{contact}',    [ContactController::class, 'update'])     ->name('contacts.patch')        ->middleware('permission:contacts.edit');
    Route::delete('/contacts/{contact}',   [ContactController::class, 'destroy'])    ->name('contacts.destroy')      ->middleware('permission:contacts.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // QUOTES
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/quotes',              [QuoteController::class, 'index']) ->name('quotes.index')  ->middleware('permission:quotes.view');
    Route::get('/quotes/create',       [QuoteController::class, 'create'])->name('quotes.create') ->middleware('permission:quotes.create');
    Route::post('/quotes',             [QuoteController::class, 'store']) ->name('quotes.store')  ->middleware('permission:quotes.create');
    Route::get('/quotes/{quote}',      [QuoteController::class, 'show'])  ->name('quotes.show')   ->middleware('permission:quotes.view');
    Route::get('/quotes/{quote}/edit', [QuoteController::class, 'edit'])  ->name('quotes.edit')   ->middleware('permission:quotes.edit');
    Route::put('/quotes/{quote}',      [QuoteController::class, 'update'])->name('quotes.update') ->middleware('permission:quotes.edit');
    Route::patch('/quotes/{quote}',    [QuoteController::class, 'update'])->name('quotes.patch')  ->middleware('permission:quotes.edit');
    Route::delete('/quotes/{quote}',   [QuoteController::class, 'destroy'])->name('quotes.destroy')->middleware('permission:quotes.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // CONTRACTS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/contracts',                 [ContractController::class, 'index']) ->name('contracts.index')  ->middleware('permission:contracts.view');
    Route::get('/contracts/create',          [ContractController::class, 'create'])->name('contracts.create') ->middleware('permission:contracts.create');
    Route::post('/contracts',                [ContractController::class, 'store']) ->name('contracts.store')  ->middleware('permission:contracts.create');
    Route::get('/contracts/{contract}',      [ContractController::class, 'show'])  ->name('contracts.show')   ->middleware('permission:contracts.view');
    Route::get('/contracts/{contract}/edit', [ContractController::class, 'edit'])  ->name('contracts.edit')   ->middleware('permission:contracts.edit');
    Route::put('/contracts/{contract}',      [ContractController::class, 'update'])->name('contracts.update') ->middleware('permission:contracts.edit');
    Route::patch('/contracts/{contract}',    [ContractController::class, 'update'])->name('contracts.patch')  ->middleware('permission:contracts.edit');
    Route::delete('/contracts/{contract}',   [ContractController::class, 'destroy'])->name('contracts.destroy')->middleware('permission:contracts.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // JOBS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/jobs',              [JobController::class, 'index']) ->name('jobs.index')  ->middleware('permission:jobs.view');
    Route::get('/jobs/create',       [JobController::class, 'create'])->name('jobs.create') ->middleware('permission:jobs.create');
    Route::post('/jobs',             [JobController::class, 'store']) ->name('jobs.store')  ->middleware('permission:jobs.create');
    Route::get('/jobs/{job}',        [JobController::class, 'show'])  ->name('jobs.show')   ->middleware('permission:jobs.view');
    Route::get('/jobs/{job}/edit',   [JobController::class, 'edit'])  ->name('jobs.edit')   ->middleware('permission:jobs.edit');
    Route::put('/jobs/{job}',        [JobController::class, 'update'])->name('jobs.update') ->middleware('permission:jobs.edit');
    Route::patch('/jobs/{job}',      [JobController::class, 'update'])->name('jobs.patch')  ->middleware('permission:jobs.edit');
    Route::delete('/jobs/{job}',     [JobController::class, 'destroy'])->name('jobs.destroy')->middleware('permission:jobs.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // WORKS ORDERS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/works-orders',                [WorksOrderController::class, 'index']) ->name('works-orders.index')  ->middleware('permission:works-orders.view');
    Route::get('/works-orders/create',         [WorksOrderController::class, 'create'])->name('works-orders.create') ->middleware('permission:works-orders.create');
    Route::post('/works-orders',               [WorksOrderController::class, 'store']) ->name('works-orders.store')  ->middleware('permission:works-orders.create');
    Route::get('/works-orders/{order}',        [WorksOrderController::class, 'show'])  ->name('works-orders.show')   ->middleware('permission:works-orders.view');
    Route::get('/works-orders/{order}/edit',   [WorksOrderController::class, 'edit'])  ->name('works-orders.edit')   ->middleware('permission:works-orders.edit');
    Route::put('/works-orders/{order}',        [WorksOrderController::class, 'update'])->name('works-orders.update') ->middleware('permission:works-orders.edit');
    Route::patch('/works-orders/{order}',      [WorksOrderController::class, 'update'])->name('works-orders.patch')  ->middleware('permission:works-orders.edit');
    Route::delete('/works-orders/{order}',     [WorksOrderController::class, 'destroy'])->name('works-orders.destroy')->middleware('permission:works-orders.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // CHECK MEASURE
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/check-measure',              [CheckMeasureController::class, 'index']) ->name('check-measure.index')  ->middleware('permission:check-measure.view');
    Route::get('/check-measure/create',       [CheckMeasureController::class, 'create'])->name('check-measure.create') ->middleware('permission:check-measure.create');
    Route::post('/check-measure',             [CheckMeasureController::class, 'store']) ->name('check-measure.store')  ->middleware('permission:check-measure.create');
    Route::get('/check-measure/{cm}',         [CheckMeasureController::class, 'show'])  ->name('check-measure.show')   ->middleware('permission:check-measure.view');
    Route::get('/check-measure/{cm}/edit',    [CheckMeasureController::class, 'edit'])  ->name('check-measure.edit')   ->middleware('permission:check-measure.edit');
    Route::put('/check-measure/{cm}',         [CheckMeasureController::class, 'update'])->name('check-measure.update') ->middleware('permission:check-measure.edit');
    Route::patch('/check-measure/{cm}',       [CheckMeasureController::class, 'update'])->name('check-measure.patch')  ->middleware('permission:check-measure.edit');
    Route::delete('/check-measure/{cm}',      [CheckMeasureController::class, 'destroy'])->name('check-measure.destroy')->middleware('permission:check-measure.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // COMPLETION
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/completion',               [CompletionController::class, 'index']) ->name('completion.index')  ->middleware('permission:completion.view');
    Route::get('/completion/create',        [CompletionController::class, 'create'])->name('completion.create') ->middleware('permission:completion.create');
    Route::post('/completion',              [CompletionController::class, 'store']) ->name('completion.store')  ->middleware('permission:completion.create');
    Route::get('/completion/{item}',        [CompletionController::class, 'show'])  ->name('completion.show')   ->middleware('permission:completion.view');
    Route::get('/completion/{item}/edit',   [CompletionController::class, 'edit'])  ->name('completion.edit')   ->middleware('permission:completion.edit');
    Route::put('/completion/{item}',        [CompletionController::class, 'update'])->name('completion.update') ->middleware('permission:completion.edit');
    Route::patch('/completion/{item}',      [CompletionController::class, 'update'])->name('completion.patch')  ->middleware('permission:completion.edit');
    Route::delete('/completion/{item}',     [CompletionController::class, 'destroy'])->name('completion.destroy')->middleware('permission:completion.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // CALENDAR
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/calendar',                  [CalendarController::class, 'index'])  ->name('calendar.index')         ->middleware('permission:calendar.view');
    Route::post('/calendar/events',          [CalendarController::class, 'store'])  ->name('calendar.events.store')  ->middleware('permission:calendar.create');
    Route::put('/calendar/events/{id}',      [CalendarController::class, 'update']) ->name('calendar.events.update') ->middleware('permission:calendar.edit');
    Route::delete('/calendar/events/{id}',   [CalendarController::class, 'destroy'])->name('calendar.events.destroy')->middleware('permission:calendar.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // APPOINTMENTS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/appointments',               [AppointmentController::class, 'index']) ->name('appointments.index')  ->middleware('permission:appointments.view');
    Route::get('/appointments/create',        [AppointmentController::class, 'create'])->name('appointments.create') ->middleware('permission:appointments.create');
    Route::post('/appointments',              [AppointmentController::class, 'store']) ->name('appointments.store')  ->middleware('permission:appointments.create');
    Route::get('/appointments/{appt}',        [AppointmentController::class, 'show'])  ->name('appointments.show')   ->middleware('permission:appointments.view');
    Route::get('/appointments/{appt}/edit',   [AppointmentController::class, 'edit'])  ->name('appointments.edit')   ->middleware('permission:appointments.edit');
    Route::put('/appointments/{appt}',        [AppointmentController::class, 'update'])->name('appointments.update') ->middleware('permission:appointments.edit');
    Route::delete('/appointments/{appt}',     [AppointmentController::class, 'destroy'])->name('appointments.destroy')->middleware('permission:appointments.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // FOLLOW-UPS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/follow-ups',          [FollowUpController::class, 'index']) ->name('follow-ups.index')  ->middleware('permission:follow-ups.view');
    Route::post('/follow-ups',         [FollowUpController::class, 'store']) ->name('follow-ups.store')  ->middleware('permission:follow-ups.create');
    Route::put('/follow-ups/{fu}',     [FollowUpController::class, 'update'])->name('follow-ups.update') ->middleware('permission:follow-ups.edit');
    Route::delete('/follow-ups/{fu}',  [FollowUpController::class, 'destroy'])->name('follow-ups.destroy')->middleware('permission:follow-ups.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // PURCHASE ORDERS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/purchase-orders',               [PurchaseOrderController::class, 'index']) ->name('purchase-orders.index')  ->middleware('permission:purchase-orders.view');
    Route::get('/purchase-orders/create',        [PurchaseOrderController::class, 'create'])->name('purchase-orders.create') ->middleware('permission:purchase-orders.create');
    Route::post('/purchase-orders',              [PurchaseOrderController::class, 'store']) ->name('purchase-orders.store')  ->middleware('permission:purchase-orders.create');
    Route::get('/purchase-orders/{po}',          [PurchaseOrderController::class, 'show'])  ->name('purchase-orders.show')   ->middleware('permission:purchase-orders.view');
    Route::get('/purchase-orders/{po}/edit',     [PurchaseOrderController::class, 'edit'])  ->name('purchase-orders.edit')   ->middleware('permission:purchase-orders.edit');
    Route::put('/purchase-orders/{po}',          [PurchaseOrderController::class, 'update'])->name('purchase-orders.update') ->middleware('permission:purchase-orders.edit');
    Route::patch('/purchase-orders/{po}',        [PurchaseOrderController::class, 'update'])->name('purchase-orders.patch')  ->middleware('permission:purchase-orders.edit');
    Route::delete('/purchase-orders/{po}',       [PurchaseOrderController::class, 'destroy'])->name('purchase-orders.destroy')->middleware('permission:purchase-orders.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // STOCKS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/stocks',              [StockController::class, 'index']) ->name('stocks.index')  ->middleware('permission:stocks.view');
    Route::get('/stocks/create',       [StockController::class, 'create'])->name('stocks.create') ->middleware('permission:stocks.create');
    Route::post('/stocks',             [StockController::class, 'store']) ->name('stocks.store')  ->middleware('permission:stocks.create');
    Route::get('/stocks/{stock}',      [StockController::class, 'show'])  ->name('stocks.show')   ->middleware('permission:stocks.view');
    Route::get('/stocks/{stock}/edit', [StockController::class, 'edit'])  ->name('stocks.edit')   ->middleware('permission:stocks.edit');
    Route::put('/stocks/{stock}',      [StockController::class, 'update'])->name('stocks.update') ->middleware('permission:stocks.edit');
    Route::delete('/stocks/{stock}',   [StockController::class, 'destroy'])->name('stocks.destroy')->middleware('permission:stocks.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // COMMERCIAL ACCOUNTS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/commercial-accounts',      [CommercialAccountController::class, 'index'])->name('commercial-accounts.index')->middleware('permission:commercial-accounts.view');
    Route::get('/commercial-accounts/{id}', [CommercialAccountController::class, 'show']) ->name('commercial-accounts.show') ->middleware('permission:commercial-accounts.view');

    // ─────────────────────────────────────────────────────────────────────────
    // SHOWROOMS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/showrooms',                [ShowroomController::class, 'index']) ->name('showrooms.index')  ->middleware('permission:showrooms.view');
    Route::get('/showrooms/create',         [ShowroomController::class, 'create'])->name('showrooms.create') ->middleware('permission:showrooms.create');
    Route::post('/showrooms',               [ShowroomController::class, 'store']) ->name('showrooms.store')  ->middleware('permission:showrooms.create');
    Route::get('/showrooms/{showroom}',     [ShowroomController::class, 'show'])  ->name('showrooms.show')   ->middleware('permission:showrooms.view');
    Route::get('/showrooms/{showroom}/edit',[ShowroomController::class, 'edit'])  ->name('showrooms.edit')   ->middleware('permission:showrooms.edit');
    Route::put('/showrooms/{showroom}',     [ShowroomController::class, 'update'])->name('showrooms.update') ->middleware('permission:showrooms.edit');
    Route::delete('/showrooms/{showroom}',  [ShowroomController::class, 'destroy'])->name('showrooms.destroy')->middleware('permission:showrooms.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // REPORTS
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/reports',         [ReportController::class, 'index'])->name('reports.index')->middleware('permission:reports.view');
    Route::get('/reports/{type}',  [ReportController::class, 'show']) ->name('reports.show') ->middleware('permission:reports.view');

    // ─────────────────────────────────────────────────────────────────────────
    // TIMESHEETS & STAFF INVOICES
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/timesheets',            [TimeEntryController::class, 'index'])->name('timesheets.index')->middleware('permission:timesheets.view');
    Route::post('/timesheets/start',     [TimeEntryController::class, 'start'])->name('timesheets.start')->middleware('permission:timesheets.create');
    Route::post('/timesheets/{id}/stop', [TimeEntryController::class, 'stop']) ->name('timesheets.stop') ->middleware('permission:timesheets.edit');

    Route::get('/staff-invoices',        [StaffInvoiceController::class, 'index']) ->name('staff-invoices.index')  ->middleware('permission:timesheets.view');
    Route::get('/staff-invoices/create', [StaffInvoiceController::class, 'create'])->name('staff-invoices.create') ->middleware('permission:timesheets.create');
    Route::post('/staff-invoices',       [StaffInvoiceController::class, 'store']) ->name('staff-invoices.store')  ->middleware('permission:timesheets.create');
    Route::get('/staff-invoices/{id}',   [StaffInvoiceController::class, 'show'])  ->name('staff-invoices.show')   ->middleware('permission:timesheets.view');
    Route::put('/staff-invoices/{id}',   [StaffInvoiceController::class, 'update'])->name('staff-invoices.update') ->middleware('permission:timesheets.edit');

    // ─────────────────────────────────────────────────────────────────────────
    // USER MANAGEMENT  (admin-level)
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/users',               [UserController::class, 'index']) ->name('users.index')  ->middleware('permission:users.view');
    Route::get('/users/create',        [UserController::class, 'create'])->name('users.create') ->middleware('permission:users.create');
    Route::post('/users',              [UserController::class, 'store']) ->name('users.store')  ->middleware('permission:users.create');
    Route::get('/users/{user}',        [UserController::class, 'show'])  ->name('users.show')   ->middleware('permission:users.view');
    Route::get('/users/{user}/edit',   [UserController::class, 'edit'])  ->name('users.edit')   ->middleware('permission:users.edit');
    Route::put('/users/{user}',        [UserController::class, 'update'])->name('users.update') ->middleware('permission:users.edit');
    Route::delete('/users/{user}',     [UserController::class, 'destroy'])->name('users.destroy')->middleware('permission:users.delete');

    // ─────────────────────────────────────────────────────────────────────────
    // ROLE & PERMISSION MANAGEMENT  (admin-level)
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/roles',                         [RoleController::class, 'index'])          ->name('roles.index')           ->middleware('permission:roles.view');
    Route::get('/roles/create',                  [RoleController::class, 'create'])         ->name('roles.create')          ->middleware('permission:roles.create');
    Route::post('/roles',                        [RoleController::class, 'store'])          ->name('roles.store')           ->middleware('permission:roles.create');
    Route::get('/roles/{role}',                  [RoleController::class, 'show'])           ->name('roles.show')            ->middleware('permission:roles.view');
    Route::get('/roles/{role}/edit',             [RoleController::class, 'edit'])           ->name('roles.edit')            ->middleware('permission:roles.edit');
    Route::put('/roles/{role}',                  [RoleController::class, 'update'])         ->name('roles.update')          ->middleware('permission:roles.edit');
    Route::delete('/roles/{role}',               [RoleController::class, 'destroy'])        ->name('roles.destroy')         ->middleware('permission:roles.delete');
    Route::post('/roles/{role}/permissions',     [RoleController::class, 'savePermissions'])->name('roles.permissions.save')->middleware('permission:roles.edit');

    // ─────────────────────────────────────────────────────────────────────────
    // SETTINGS  (admin-level)
    // ─────────────────────────────────────────────────────────────────────────
    Route::get('/settings',       [SettingController::class, 'index'])     ->name('settings.index')  ->middleware('permission:settings.view');
    Route::post('/settings',      [SettingController::class, 'update'])    ->name('settings.update') ->middleware('permission:settings.edit');
    Route::post('/settings/logo', [SettingController::class, 'uploadLogo'])->name('settings.logo')   ->middleware('permission:settings.edit');

});