<?php

declare(strict_types=1);

use App\Controllers\PlatformAdmin\PlatformAuthController;
use App\Controllers\PlatformAdmin\PlatformCompanyController;
use App\Controllers\PlatformAdmin\PlatformSubscriptionCodeController;

/**
 * routes/platform.php
 *
 * The software owner's console — point admin.<APP_DOMAIN> here (a
 * separate vhost/subdomain from the tenant app; see
 * deploy/apache-vhost.conf). Guarded by 'platform_admin', never
 * 'tenant' or 'auth' — this is a different identity space entirely
 * (App\Core\PlatformAuth), on purpose, so a tenant's own "Admin" role
 * can never reach it.
 */

/** @var \App\Core\Router $router */

$router->get('/platform/login', [PlatformAuthController::class, 'showLoginForm']);
$router->post('/platform/login', [PlatformAuthController::class, 'login'], middleware: ['csrf']);
$router->post('/platform/logout', [PlatformAuthController::class, 'logout'], middleware: ['platform_admin', 'csrf']);

$router->get('/platform/companies', [PlatformCompanyController::class, 'index'], middleware: ['platform_admin']);
$router->get('/platform/companies/onboard', [PlatformCompanyController::class, 'showOnboard'], middleware: ['platform_admin']);
$router->post('/platform/companies/onboard', [PlatformCompanyController::class, 'onboard'], middleware: ['platform_admin', 'csrf']);
$router->post('/platform/companies/{businessLineId}/suspend', [PlatformCompanyController::class, 'suspend'], middleware: ['platform_admin', 'csrf']);

$router->get('/platform/codes', [PlatformSubscriptionCodeController::class, 'index'], middleware: ['platform_admin']);
$router->post('/platform/codes', [PlatformSubscriptionCodeController::class, 'create'], middleware: ['platform_admin', 'csrf']);
$router->post('/platform/codes/{codeId}/revoke', [PlatformSubscriptionCodeController::class, 'revoke'], middleware: ['platform_admin', 'csrf']);
