<?php

use App\Http\Controllers\ProfileController;
use App\Http\Controllers\TrackController;
use App\Http\Controllers\MediaController;
use App\Http\Controllers\Admin\CandidateController;
use App\Http\Controllers\Admin\AgentController;
use App\Http\Controllers\Admin\CompanyController;
use App\Http\Controllers\Agent\AgentCandidateController;
use App\Http\Controllers\Agent\AgentDashboardController;
use App\Http\Controllers\Admin\RecruitmentCaseController;
use App\Http\Controllers\Admin\PaymentController;
use App\Http\Controllers\Admin\ExpenseController;
use App\Http\Controllers\Admin\StaffController;
use App\Http\Controllers\Admin\SalaryController;
use App\Http\Controllers\Admin\UserController;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\Auth;

use App\Http\Controllers\Frontend\PageController;
use App\Http\Controllers\Frontend\VisaInquiryController as FrontVisaInquiryController;
use App\Http\Controllers\Webhook\GreenApiWebhookController;
use App\Http\Controllers\Admin\VisaInquiryController as AdminVisaInquiryController;
use App\Http\Controllers\Admin\VisaSlideController;
use App\Http\Controllers\Admin\HostingEmailController;

// Public pages
Route::get('/', [PageController::class, 'home'])->name('home');
Route::get('/about', [PageController::class, 'about'])->name('about');
Route::get('/services', [PageController::class, 'services'])->name('services');
Route::get('/contact', [PageController::class, 'contact'])->name('contact');
Route::get('/visa-requirements', [PageController::class, 'visaRequirements'])->name('visa.requirements');
Route::get('/thank-you', [PageController::class, 'thankYou'])->name('thankyou');

// Visa inquiry form submit (public)
Route::post('/visa-inquiry', [FrontVisaInquiryController::class, 'store'])->name('visa.inquiry.store');

// GREEN-API incoming webhook (optional)
Route::post('/webhooks/greenapi', [GreenApiWebhookController::class, 'handle'])->name('webhooks.greenapi');

// Tracking routes
// /track search is staff-only, but /t/{token} is public for WhatsApp notifications.
Route::middleware(['auth', 'permission:track'])->get('/track', [TrackController::class, 'form'])->name('track.form');
Route::middleware(['auth', 'permission:track'])->post('/track', [TrackController::class, 'show'])->name('track.show');
Route::get('/t/{token}', [TrackController::class, 'showByToken'])->name('track.token');

// Media (served via Laravel to avoid /storage symlink 403 issues)
Route::get('/media/candidate/photo/{candidate}', [MediaController::class, 'candidatePhoto'])->name('media.candidate.photo');
Route::middleware('auth')->get('/media/candidate/passport/{candidate}', [MediaController::class, 'candidatePassport'])->name('media.candidate.passport');

Route::get('/dashboard', function () {
    $user = Auth::user();

    if ($user && ($user->role ?? 'admin') === 'agent') {
        return redirect()->route('agent.dashboard');
    }

    if ($user && ($user->isAdmin() || $user->hasPermission('dashboard'))) {
        return view('dashboard');
    }

    // Staff/user accounts without dashboard permission should not see the admin analytics dashboard.
    // Send them to the first module they are allowed to access.
    if ($user?->hasPermission('candidates')) {
        return redirect()->route('admin.candidates.index');
    }
    if ($user?->hasPermission('staff')) {
        return redirect()->route('admin.staffs.index');
    }
    if ($user?->hasPermission('salaries')) {
        return redirect()->route('admin.salaries.index');
    }
    if ($user?->hasPermission('visa_inquiries')) {
        return redirect()->route('admin.visa_inquiries.index');
    }
    if ($user?->hasPermission('visa_slides')) {
        return redirect()->route('admin.visa_slides.index');
    }
    if ($user?->hasPermission('hosting_emails')) {
        return redirect()->route('admin.hosting-emails.index');
    }
    if ($user?->hasPermission('manage_users')) {
        return redirect()->route('admin.users.index');
    }
    if ($user?->hasPermission('track')) {
        return redirect()->route('track.form');
    }

    abort(403);
})->middleware(['auth', 'verified'])->name('dashboard');

Route::middleware('auth')->group(function () {
    Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');
    Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');
    Route::delete('/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');

    // Admin area
    Route::prefix('admin')->name('admin.')->middleware('admin')->group(function () {
        // User management
        Route::resource('users', UserController::class)->except(['show'])->middleware('permission:manage_users');

        Route::resource('agents', AgentController::class)->except(['destroy', 'show']);
        Route::resource('companies', CompanyController::class)->except(['destroy', 'show']);

        Route::get('candidates/export/excel', [CandidateController::class, 'exportExcel'])->name('candidates.export.excel')->middleware('permission:candidates');
        Route::get('candidates/export/pdf', [CandidateController::class, 'exportPdf'])->name('candidates.export.pdf')->middleware('permission:candidates');
        Route::post('candidates/{candidate}/track-permission', [CandidateController::class, 'toggleTrackPermission'])->name('candidates.track_permission')->middleware('permission:candidates');
        Route::resource('candidates', CandidateController::class)->except(['destroy'])->middleware('permission:candidates');

        Route::resource('staffs', StaffController::class)->except(['show', 'destroy'])->middleware('permission:staff');
        Route::get('salaries', [SalaryController::class, 'index'])->name('salaries.index')->middleware('permission:salaries');
        Route::post('salaries/generate', [SalaryController::class, 'generate'])->name('salaries.generate')->middleware('permission:salaries');
        Route::get('salaries/{salary}', [SalaryController::class, 'show'])->name('salaries.show')->middleware('permission:salaries');
        Route::post('salaries/{salary}', [SalaryController::class, 'update'])->name('salaries.update')->middleware('permission:salaries');
        Route::post('salaries/{salary}/payments', [SalaryController::class, 'addPayment'])->name('salaries.payments.store')->middleware('permission:salaries');
        Route::delete('salaries/{salary}/payments/{payment}', [SalaryController::class, 'deletePayment'])->name('salaries.payments.destroy')->middleware('permission:salaries');

        Route::get('cases/{case}', [RecruitmentCaseController::class, 'show'])->name('cases.show')->middleware('permission:candidates');
        // Pricing update: some forms submit as PATCH (method spoofing), while others may POST.
        // Accept both to avoid MethodNotAllowed errors.
        Route::match(['post', 'patch'], 'cases/{case}/pricing', [RecruitmentCaseController::class, 'updatePricing'])
            ->name('cases.pricing')
            ->middleware('permission:candidates');
        Route::post('cases/{case}/steps', [RecruitmentCaseController::class, 'addStep'])->name('cases.steps.add')->middleware('permission:candidates');
        Route::patch('cases/{case}/steps/{caseStep}', [RecruitmentCaseController::class, 'updateStep'])->name('cases.steps.update')->middleware('permission:candidates');
        Route::delete('cases/{case}/steps/{caseStep}', [RecruitmentCaseController::class, 'deleteStep'])->name('cases.steps.delete')->middleware('permission:candidates');

        Route::post('cases/{case}/payments', [PaymentController::class, 'store'])->name('cases.payments.store')->middleware('permission:candidates');
        Route::delete('cases/{case}/payments/{payment}', [PaymentController::class, 'destroy'])->name('cases.payments.destroy')->middleware('permission:candidates');

        Route::post('cases/{case}/expenses', [ExpenseController::class, 'store'])->name('cases.expenses.store')->middleware('permission:candidates');
        Route::delete('cases/{case}/expenses/{expense}', [ExpenseController::class, 'destroy'])->name('cases.expenses.destroy')->middleware('permission:candidates');

        // Visa inquiries
        Route::get('visa-inquiries', [AdminVisaInquiryController::class, 'index'])->name('visa_inquiries.index')->middleware('permission:visa_inquiries');
        Route::get('visa-inquiries/{visaInquiry}', [AdminVisaInquiryController::class, 'show'])->name('visa_inquiries.show')->middleware('permission:visa_inquiries');
        Route::patch('visa-inquiries/{visaInquiry}/status', [AdminVisaInquiryController::class, 'updateStatus'])->name('visa_inquiries.status')->middleware('permission:visa_inquiries');
        Route::delete('visa-inquiries/{visaInquiry}', [AdminVisaInquiryController::class, 'destroy'])->name('visa_inquiries.destroy')->middleware('permission:visa_inquiries');


        // Hosting email accounts (cPanel UAPI)
        Route::get('hosting-emails', [HostingEmailController::class, 'index'])->name('hosting-emails.index')->middleware('permission:hosting_emails');
        Route::post('hosting-emails', [HostingEmailController::class, 'store'])->name('hosting-emails.store')->middleware('permission:hosting_emails');
        Route::get('hosting-emails/inbox', [HostingEmailController::class, 'openInbox'])->name('hosting-emails.inbox')->middleware('permission:hosting_emails');
        Route::patch('hosting-emails/password', [HostingEmailController::class, 'updatePassword'])->name('hosting-emails.password')->middleware('permission:hosting_emails');
        Route::delete('hosting-emails', [HostingEmailController::class, 'destroy'])->name('hosting-emails.destroy')->middleware('permission:hosting_emails');

        // Visa hero slider (Visa Requirements page)
        Route::resource('visa-slides', VisaSlideController::class)
            ->except(['show'])
            ->parameters(['visa-slides' => 'visaSlide'])
            ->names('visa_slides')
            ->middleware('permission:visa_slides');

        // Visa inquiry attachments (served via Laravel to avoid /storage 403 issues)
        Route::get('visa-inquiries/{visaInquiry}/applicant-photo', [MediaController::class, 'visaApplicantPhoto'])->name('visa_inquiries.media.applicant_photo')->middleware('permission:visa_inquiries');
        Route::get('visa-inquiries/{visaInquiry}/passport-copy', [MediaController::class, 'visaPassportCopy'])->name('visa_inquiries.media.passport_copy')->middleware('permission:visa_inquiries');

        
    });

    // Agent area
    Route::prefix('agent')->name('agent.')->middleware('agent')->group(function () {
        Route::get('/dashboard', [AgentDashboardController::class, 'index'])->name('dashboard');
        Route::get('/candidates', [AgentCandidateController::class, 'index'])->name('candidates.index');
        Route::get('/candidates/{candidate}', [AgentCandidateController::class, 'show'])->name('candidates.show');
    });
});

require __DIR__.'/auth.php';