<?php

declare(strict_types=1);

use App\Controllers\BillingController;
use App\Controllers\Public\BillingWebhookController;
use App\Controllers\Public\SignupController;

/**
 * routes/public.php
 *
 * Two different audiences share this file:
 *
 *  - SignupController + BillingWebhookController run WITHOUT the
 *    'tenant' middleware — there's no company yet (signup) or the
 *    caller isn't a browser at all (Stripe's webhook). These are
 *    reached on the root/marketing domain and admin.<APP_DOMAIN>
 *    should NOT be pointed at them.
 *
 *  - BillingController DOES run behind 'tenant' — it's the wall a
 *    specific company sees on their own subdomain once their
 *    subscription lapses, so it needs 'tenant' to know which company
 *    that is. See TenantMiddleware::BILLING_ROUTE_PREFIXES for why
 *    these specific paths stay reachable even while expired.
 */

/** @var \App\Core\Router $router */

// ---- Public signup (root/marketing domain) ----
$router->get('/signup', [SignupController::class, 'showForm']);
$router->post('/signup', [SignupController::class, 'submit'], middleware: ['csrf']);
$router->get('/signup/activate/{businessLineId}', [SignupController::class, 'showActivate']);
$router->post('/signup/activate/{businessLineId}/checkout', [SignupController::class, 'checkout'], middleware: ['csrf']);
$router->post('/signup/activate/{businessLineId}/redeem-code', [SignupController::class, 'redeemCode'], middleware: ['csrf']);

// ---- Stripe webhook — unauthenticated, signature-verified inside the controller ----
$router->post('/webhooks/stripe', [BillingWebhookController::class, 'handle']);

// ---- Per-tenant billing wall (subdomain-aware) ----
$router->get('/billing/expired', [BillingController::class, 'expired'], middleware: ['tenant']);
$router->post('/billing/checkout', [BillingController::class, 'checkout'], middleware: ['tenant', 'auth', 'csrf']);
$router->post('/billing/redeem-code', [BillingController::class, 'redeemCode'], middleware: ['tenant', 'auth', 'csrf']);
