<?php

use App\Http\Controllers\Api\V1\BanCheckController;
use App\Http\Controllers\Api\V1\CharacterSyncController;
use App\Http\Controllers\Api\V1\DiscordRoleSyncController;
use App\Http\Controllers\Api\V1\LinkAccountController;
use App\Http\Controllers\Api\V1\ServerHeartbeatController;
use App\Http\Controllers\Api\V1\WhitelistCheckController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| REST API for FiveM Lua resources
|--------------------------------------------------------------------------
|
| Every route here is authenticated with a Sanctum personal access token
| scoped to a single game server (see `fivem.api` middleware /
| App\Http\Middleware\AuthenticateFiveMApiToken). This is a completely
| separate credential from the dashboard session auth used by routes/web.php
| — a leaked server API token can't be used to log into the UCP as a player
| or admin, and vice versa.
|
| Rate limited via the `api` throttle (see bootstrap/app.php).
|
*/

Route::middleware(['fivem.api', 'throttle:api'])
    ->prefix('v1')
    ->name('api.v1.')
    ->group(function () {
        // Called from the resource's server-side on player connect.
        Route::get('/players/{license}/ban-check', BanCheckController::class)->name('ban-check');
        Route::get('/players/{license}/whitelist-check', WhitelistCheckController::class)->name('whitelist-check');

        // Called periodically (or on job/gang/money change) to push a
        // character snapshot the dashboard can read without querying the
        // live `fivem` DB connection directly for hot data.
        Route::post('/characters/sync', [CharacterSyncController::class, 'store'])->name('characters.sync');

        // Redeems a /linkucp code (see Player\ProfileController::generateLinkCode).
        Route::post('/link-account', [LinkAccountController::class, 'store'])->name('link-account');

        // Called by a scheduled Lua export or resource start to report
        // player count / resource list for the admin "Live Server Status" page.
        Route::post('/server/heartbeat', ServerHeartbeatController::class)->name('server.heartbeat');

        // Pulled by the Discord bot / qb-core resource after the UCP
        // recalculates a user's roles, so in-game permissions can react
        // without waiting for the next Discord login.
        Route::get('/discord/role-sync/{discordId}', DiscordRoleSyncController::class)->name('discord.role-sync');
    });
