<?php

use App\Http\Controllers\WebhookReceiveController;
use App\Http\Controllers\FormSubmitController;
use App\Http\Controllers\FormEmbedController;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider and all of them will
| be assigned to the "api" middleware group. Make something great!
|
*/

Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

// Public inbound contact webhook - no auth, identified by the unguessable
// UUID (+ optional HMAC signature). Lives here (not routes/web.php) so it
// gets the "api" group's throttling and no CSRF/session requirement, and
// so config/cors.php's "api/*" rule already allows cross-origin form posts.
Route::post('webhooks/receive/{uuid}', [WebhookReceiveController::class, 'store'])->name('webhooks.receive');
Route::post('webhooks/incoming/{campaign}/{node}', [WebhookReceiveController::class, 'incomingWebhook'])->name('webhooks.incoming');

// Public inbound form-submission endpoints backing the embed code generated
// by App\Services\FormEmbedBuilder - same "unguessable UUID, no session"
// model as the webhook endpoints above.
Route::post('forms/submit/{uuid}',  [FormSubmitController::class, 'store'])->name('forms.submit');
Route::get('forms/{uuid}/popup.js', [FormEmbedController::class, 'script'])->name('forms.script');
Route::get('forms/{uuid}/embed.js', [FormEmbedController::class, 'inlineScript'])->name('forms.embed-script');
Route::post('forms/{uuid}/view',    [FormEmbedController::class, 'view'])->name('forms.view');
