<?php

use App\Modules\Pilkades\Http\Controllers\Api\DeviceTokenController;
use App\Modules\Pilkades\Http\Controllers\Api\SuperAdmin\DesaApiController;
use App\Modules\Pilkades\Http\Controllers\Api\SuperAdmin\KabupatenApiController;
use App\Modules\Pilkades\Http\Controllers\Api\SuperAdmin\KecamatanApiController;
use Illuminate\Support\Facades\Route;

Route::post('device-tokens', [DeviceTokenController::class, 'store'])
    ->middleware('throttle:30,1')
    ->name('api.device-tokens.store');

/*
|--------------------------------------------------------------------------
| Super Admin remote management API (Sanctum token, scoped abilities)
|--------------------------------------------------------------------------
|
| Deliberately limited to wilayah data (Kabupaten/Kecamatan/Desa). Voter/NIK
| data is intentionally NOT exposed here — see ApiAbility for the fixed
| ability catalogue and the rationale.
*/
Route::middleware(['auth:sanctum', 'throttle:60,1'])
    ->prefix('super-admin')
    ->name('api.super-admin.')
    ->group(function () {
        Route::middleware('ability:kabupaten:read')->group(function () {
            Route::get('kabupaten', [KabupatenApiController::class, 'index'])->name('kabupaten.index');
            Route::get('kabupaten/{kabupaten}', [KabupatenApiController::class, 'show'])->name('kabupaten.show');
        });
        Route::middleware('ability:kabupaten:write')->group(function () {
            Route::post('kabupaten', [KabupatenApiController::class, 'store'])->name('kabupaten.store');
            Route::put('kabupaten/{kabupaten}', [KabupatenApiController::class, 'update'])->name('kabupaten.update');
            Route::delete('kabupaten/{kabupaten}', [KabupatenApiController::class, 'destroy'])->name('kabupaten.destroy');
        });

        Route::middleware('ability:kecamatan:read')->group(function () {
            Route::get('kecamatan', [KecamatanApiController::class, 'index'])->name('kecamatan.index');
            Route::get('kecamatan/{kecamatan}', [KecamatanApiController::class, 'show'])->name('kecamatan.show');
        });
        Route::middleware('ability:kecamatan:write')->group(function () {
            Route::post('kecamatan', [KecamatanApiController::class, 'store'])->name('kecamatan.store');
            Route::put('kecamatan/{kecamatan}', [KecamatanApiController::class, 'update'])->name('kecamatan.update');
            Route::delete('kecamatan/{kecamatan}', [KecamatanApiController::class, 'destroy'])->name('kecamatan.destroy');
        });

        Route::middleware('ability:desa:read')->group(function () {
            Route::get('desa', [DesaApiController::class, 'index'])->name('desa.index');
            Route::get('desa/{desa}', [DesaApiController::class, 'show'])->name('desa.show');
        });
        Route::middleware('ability:desa:write')->group(function () {
            Route::post('desa', [DesaApiController::class, 'store'])->name('desa.store');
            Route::put('desa/{desa}', [DesaApiController::class, 'update'])->name('desa.update');
            Route::delete('desa/{desa}', [DesaApiController::class, 'destroy'])->name('desa.destroy');
        });
    });
