<?php

use App\Http\Controllers\Api\V1\CategoryController;
use App\Http\Controllers\Api\V1\CompanyController;
use App\Http\Controllers\Api\V1\NewsletterSubscriptionController;
use App\Http\Controllers\Api\V1\PressReleaseController;
use App\Http\Controllers\Api\V1\PressReleaseImageController;
use App\Http\Middleware\EnsureApiTokenRateLimit;
use App\Http\Middleware\EnsureApiUserIsActive;
use Illuminate\Support\Facades\Route;

Route::prefix('v1')
    ->middleware(['auth:sanctum', EnsureApiUserIsActive::class, EnsureApiTokenRateLimit::class])
    // Controller erwarten int-IDs — nicht-numerische Werte (z. B. vergessene
    // Platzhalter wie „PM_ID") sollen 404 statt TypeError/500 ergeben.
    ->where(['pressRelease' => '[0-9]+', 'pressReleaseImage' => '[0-9]+', 'company' => '[0-9]+'])
    ->group(function (): void {
        Route::apiResource('press-releases', PressReleaseController::class)
            ->parameters(['press-releases' => 'pressRelease']);
        Route::post('press-releases/{pressRelease}/submit', [PressReleaseController::class, 'submit'])
            ->name('press-releases.submit');
        Route::get('press-releases/{pressRelease}/images', [PressReleaseImageController::class, 'index'])
            ->name('press-releases.images.index');
        Route::post('press-releases/{pressRelease}/images', [PressReleaseImageController::class, 'store'])
            ->name('press-releases.images.store');
        Route::delete('press-release-images/{pressReleaseImage}', [PressReleaseImageController::class, 'destroy'])
            ->name('press-release-images.destroy');
        Route::apiResource('companies', CompanyController::class)->only(['index', 'show']);
        Route::get('categories', [CategoryController::class, 'index'])->name('categories.index');
        Route::post('newsletter/subscribe', [NewsletterSubscriptionController::class, 'store'])
            ->name('newsletter.subscribe');
    });