<?php
namespace Modules\Cotacoes;

use Gestoreasy\Core\Module\ModuleInterface;
use Gestoreasy\Core\Routing\Router;
use Gestoreasy\Core\Auth\AuthMiddleware;
use Gestoreasy\Core\Auth\Rbac;
use Modules\Cotacoes\Controllers\PurchaseQuotesController;

class Module implements ModuleInterface {
    public function register(Router $router): void {
        $ctrl = new PurchaseQuotesController();
        // API: Cotações de compras
        $router->get('/api/compras/cotacoes', [$ctrl, 'index'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.read'])]);
        // Fluxo público de resposta (sem autenticação, protegido por token de convite)
        // Registrar antes das rotas dinâmicas para evitar captura por /{id}
        $router->get('/api/compras/cotacoes/responder', [$ctrl, 'getInviteByToken']);
        $router->post('/api/compras/cotacoes/responder', [$ctrl, 'submitResponse']);
        // Rotas específicas devem vir antes da dinâmica {id}
        $router->get('/api/compras/cotacoes/melhores-ofertas', [$ctrl, 'bestOffers'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.read'])]);
        $router->get('/api/compras/cotacoes/{id}', [$ctrl, 'show'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.read'])]);
        $router->post('/api/compras/cotacoes', [$ctrl, 'store'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.create'])]);
        $router->put('/api/compras/cotacoes/{id}', [$ctrl, 'update'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.update'])]);
        $router->patch('/api/compras/cotacoes/{id}', [$ctrl, 'update'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.update'])]);
        $router->delete('/api/compras/cotacoes/{id}', [$ctrl, 'destroy'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.delete'])]);
        // Envio de convite ao fornecedor com token
        $router->post('/api/compras/cotacoes/{id}/enviar-convite', [$ctrl, 'sendInvite'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.update'])]);
        $router->get('/api/compras/cotacoes/{id}/convites-respostas', [$ctrl, 'listInvitesAndResponses'], [AuthMiddleware::requireAuth(), Rbac::requirePermissions(['cotacoes.read'])]);

        // View pública para resposta de cotação
        $router->get('/cotacoes/responder', function($r){
            return \Gestoreasy\Core\View\View::renderWithLayout('cotacoes/responder', [
                'title' => 'Responder Cotação',
                'hideMenus' => true
            ]);
        });
    }
    public function name(): string { return 'Cotacoes'; }
    public function version(): string { return '0.1.0'; }
    public function dependencies(): array { return ['Compras', 'Produtos']; }
}