<?php

declare(strict_types=1);

/**
 * routes/api.php
 *
 * JSON/AJAX endpoints called via fetch() from the frontend's inline
 * scripts (see assets/js/app-data.js). All prefixed /api/v1 from day
 * one — see the docblock in the original scaffold of this file for
 * why that matters even this early.
 */

use App\Controllers\NotificationController;
use App\Controllers\PermissionController;
use App\Core\Request;
use App\Helpers\AjaxResponse;

/** @var \App\Core\Router $router */

$router->get('/api/v1/health', function (Request $request) {
    return AjaxResponse::success(['status' => 'ok', 'time' => now()]);
});

$router->get('/api/v1/notifications', [NotificationController::class, 'index'], middleware: ['auth']);
$router->get('/api/v1/notifications/unread-count', [NotificationController::class, 'unreadCount'], middleware: ['auth']);
$router->post('/api/v1/notifications/{id}/read', [NotificationController::class, 'markRead'], middleware: ['auth', 'csrf']);
$router->post('/api/v1/notifications/read-all', [NotificationController::class, 'markAllRead'], middleware: ['auth', 'csrf']);

$router->get('/api/v1/permissions/matrix', [PermissionController::class, 'matrix'], middleware: ['auth', 'permission:user_management.manage']);

// ---------------------------------------------------------------
// External API — third-party integrations, authenticated by
// Authorization: Bearer <api_key> (see Admin > API Keys), NOT the
// session cookie. See docs/API.md for the full reference.
// ---------------------------------------------------------------

use App\Controllers\ExternalApiController;

$router->get('/api/v1/external/leads', [ExternalApiController::class, 'leadsIndex'], middleware: ['api_key']);
$router->get('/api/v1/external/leads/{id}', [ExternalApiController::class, 'leadsShow'], middleware: ['api_key']);
$router->post('/api/v1/external/leads', [ExternalApiController::class, 'leadsStore'], middleware: ['api_key']);
$router->get('/api/v1/external/customers', [ExternalApiController::class, 'customersIndex'], middleware: ['api_key']);
$router->get('/api/v1/external/customers/{id}', [ExternalApiController::class, 'customersShow'], middleware: ['api_key']);
