<?php

use App\Http\Controllers\Api\DeviceHeartbeatController;
use App\Http\Controllers\Api\VisitController;
use App\Http\Controllers\Api\VisitorController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| Ladill Frontdesk — internal service API
|--------------------------------------------------------------------------
| Authenticated with per-consumer service keys (Authorization: Bearer
| <FRONTDESK_API_KEY_*>) via auth.service:frontdesk. Scoped with ?owner=
| (platform user public_id / OIDC sub).
*/

Route::post('devices/heartbeat', DeviceHeartbeatController::class)->middleware('throttle:device-heartbeat')->name('devices.heartbeat');
Route::post('kiosk/offline-sync', [\App\Http\Controllers\Api\OfflineSyncController::class, 'store'])->middleware('throttle:kiosk-device')->name('kiosk.offline-sync');

Route::middleware('auth.service:frontdesk')->group(function () {
    Route::apiResource('visits', VisitController::class)->only(['index', 'store', 'show']);
    Route::post('visits/{visit}/checkout', [VisitController::class, 'checkOut'])->name('visits.checkout');
    Route::post('visits/{visit}/activate', [VisitController::class, 'activate'])->name('visits.activate');
    Route::post('visits/{visit}/approve', [VisitController::class, 'approve'])->name('visits.approve');
    Route::post('visits/{visit}/cancel', [VisitController::class, 'cancel'])->name('visits.cancel');

    Route::get('visitors', [VisitorController::class, 'index'])->name('visitors.index');
    Route::get('visitors/{visitor}', [VisitorController::class, 'show'])->name('visitors.show');
});