📄 api.php

<?php

use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| API Routes (Sanctum-protected)
|--------------------------------------------------------------------------
| Prefix: /api  (set in bootstrap/app.php)
| Auth:   Laravel Sanctum token (Authorization: Bearer <token>)
|
| Phase 1: Basic product/catalog read endpoints + order status.
| Phase 4+: Full public API with OpenAPI docs (Scribe).
*/

// ── Public Endpoints (no auth) ────────────────────────────────────────────────
Route::prefix('v1')->name('api.v1.')->group(function () {

    // Catalog
    Route::get('/products', [\App\Modules\Catalog\Controllers\Api\ProductApiController::class, 'index'])
        ->name('products.index');
    Route::get('/products/{slug}', [\App\Modules\Catalog\Controllers\Api\ProductApiController::class, 'show'])
        ->name('products.show');
    Route::get('/categories', [\App\Modules\Catalog\Controllers\Api\CategoryApiController::class, 'index'])
        ->name('categories.index');

    // Search autocomplete
    Route::get('/search', [\App\Modules\Search\Controllers\SearchController::class, 'apiSearch'])
        ->name('search');

    // ── Auth Endpoints ────────────────────────────────────────────────────────
    Route::post('/auth/register', [\App\Modules\Auth\Controllers\Api\AuthApiController::class, 'register'])
        ->name('auth.register');
    Route::post('/auth/login', [\App\Modules\Auth\Controllers\Api\AuthApiController::class, 'login'])
        ->name('auth.login');

    // ── Sanctum Protected ─────────────────────────────────────────────────────
    Route::middleware('auth:sanctum')->group(function () {

        Route::post('/auth/logout', [\App\Modules\Auth\Controllers\Api\AuthApiController::class, 'logout'])
            ->name('auth.logout');
        Route::get('/auth/user', [\App\Modules\Auth\Controllers\Api\AuthApiController::class, 'me'])
            ->name('auth.me');

        // Cart
        Route::prefix('cart')->name('cart.')->group(function () {
            Route::get('/', [\App\Modules\Cart\Controllers\Api\CartApiController::class, 'show'])->name('show');
            Route::post('/add', [\App\Modules\Cart\Controllers\Api\CartApiController::class, 'add'])->name('add');
            Route::patch('/item/{id}', [\App\Modules\Cart\Controllers\Api\CartApiController::class, 'update'])->name('update');
            Route::delete('/item/{id}', [\App\Modules\Cart\Controllers\Api\CartApiController::class, 'remove'])->name('remove');
        });

        // Orders
        Route::prefix('orders')->name('orders.')->group(function () {
            Route::get('/', [\App\Modules\Order\Controllers\Api\OrderApiController::class, 'index'])->name('index');
            Route::get('/{orderNumber}', [\App\Modules\Order\Controllers\Api\OrderApiController::class, 'show'])->name('show');
            Route::post('/place', [\App\Modules\Order\Controllers\Api\OrderApiController::class, 'place'])->name('place');
        });

        // Profile
        Route::get('/profile', [\App\Modules\User\Controllers\Api\ProfileApiController::class, 'show'])->name('profile');
        Route::put('/profile', [\App\Modules\User\Controllers\Api\ProfileApiController::class, 'update'])->name('profile.update');
        Route::apiResource('/addresses', \App\Modules\User\Controllers\Api\AddressApiController::class);

        // Phase 4: Reviews
        Route::prefix('reviews')->name('reviews.')->group(function () {
            Route::post('/products/{productId}', [\App\Modules\Reviews\Http\Controllers\Api\ReviewApiController::class, 'store'])->name('store');
            Route::get('/products/{productId}', [\App\Modules\Reviews\Http\Controllers\Api\ReviewApiController::class, 'index'])->name('index')->withoutMiddleware('auth:sanctum');
            Route::post('/{review}/helpful', [\App\Modules\Reviews\Http\Controllers\Api\ReviewApiController::class, 'helpful'])->name('helpful');
        });

        // Phase 4: Q&A
        Route::prefix('products/{productId}/questions')->name('questions.')->group(function () {
            Route::get('/', [\App\Modules\Reviews\Http\Controllers\Api\QuestionApiController::class, 'index'])->name('index')->withoutMiddleware('auth:sanctum');
            Route::post('/', [\App\Modules\Reviews\Http\Controllers\Api\QuestionApiController::class, 'store'])->name('store');
        });

        // Phase 4: Flash Sales (public)
        Route::get('/flash-sales', [\App\Modules\Promotions\Http\Controllers\Api\FlashSaleApiController::class, 'index'])
            ->name('flash-sales.index')
            ->withoutMiddleware('auth:sanctum');

        // Phase 4: Gift Cards
        Route::prefix('gift-cards')->name('gift-cards.')->group(function () {
            Route::post('/check-balance', [\App\Modules\Promotions\Http\Controllers\Api\GiftCardApiController::class, 'checkBalance'])
                ->name('check-balance')
                ->withoutMiddleware('auth:sanctum');
        });

        // Phase 4: Loyalty points
        Route::get('/loyalty/balance', [\App\Modules\Promotions\Http\Controllers\Api\LoyaltyApiController::class, 'balance'])->name('loyalty.balance');
        Route::get('/loyalty/history', [\App\Modules\Promotions\Http\Controllers\Api\LoyaltyApiController::class, 'history'])->name('loyalty.history');

        // Phase 4: Notifications
        Route::prefix('notifications')->name('notifications.')->group(function () {
            Route::get('/', [\App\Http\Controllers\Api\V1\NotificationApiController::class, 'index'])->name('index');
            Route::post('/{id}/read', [\App\Http\Controllers\Api\V1\NotificationApiController::class, 'markRead'])->name('read');
            Route::post('/read-all', [\App\Http\Controllers\Api\V1\NotificationApiController::class, 'markAllRead'])->name('read-all');
        });

        // Phase 4: Support Tickets
        Route::apiResource('/support/tickets', \App\Modules\Support\Http\Controllers\Api\TicketApiController::class)
            ->only(['index', 'store', 'show']);
        Route::post('/support/tickets/{ticket}/replies', [\App\Modules\Support\Http\Controllers\Api\TicketApiController::class, 'reply'])
            ->name('support.tickets.reply');
    });

    // Phase 4: Blog (public)
    Route::prefix('blog')->name('blog.')->group(function () {
        Route::get('/posts', [\App\Modules\Blog\Http\Controllers\Api\BlogApiController::class, 'index'])->name('posts.index');
        Route::get('/posts/{slug}', [\App\Modules\Blog\Http\Controllers\Api\BlogApiController::class, 'show'])->name('posts.show');
        Route::get('/categories', [\App\Modules\Blog\Http\Controllers\Api\BlogApiController::class, 'categories'])->name('categories.index');
    });
});