<?php

/**
 * Auth Module — Route Definitions (AUTH-001, AUTH-002, AUTH-003)
 *
 * Registers all routes owned by the Auth module for the current sprint.
 * This file is loaded by routes/public.php.
 *
 * AUTH-001 routes:
 *   GET  /login                     → AuthController@showLogin           — unified login form
 *   POST /login                     → AuthController@processLogin        — process credentials
 *
 * AUTH-002 routes:
 *   POST /logout                    → AuthController@logout              — destroy session
 *   GET  /logout is intentionally NOT registered. Logout must use POST only.
 *
 * AUTH-003 routes:
 *   GET  /forgot-password           → AuthController@showForgotPassword    — forgot-password form
 *   POST /forgot-password           → AuthController@processForgotPassword — request reset token
 *   GET  /reset-password/{token}    → AuthController@showResetPassword     — reset-password form
 *   POST /reset-password/{token}    → AuthController@processResetPassword  — apply new password
 *
 * Middleware:
 *   POST /login                     is protected by CsrfMiddleware.
 *   POST /logout                    is protected by CsrfMiddleware.
 *   POST /forgot-password           is protected by CsrfMiddleware.
 *   POST /reset-password/{token}    is protected by CsrfMiddleware.
 *   GET  /login, /forgot-password, /reset-password/{token} have no middleware (public pages).
 *
 * Available variable: $router (App\Core\Router instance — injected by routes/public.php)
 *
 * @package Inveetaire
 * @ref     SPRINT2_PLANNING.md §5, DBP v1.1 Ch.7, AUTH-001, AUTH-002, AUTH-003
 */

// ── GET /admin — Operator Admin Login ─────────────────────────────────────────
$router->get('/admin', 'App\\Modules\\Auth\\AuthController@showAdminLogin');

// ── POST /admin — Process Operator Admin Login ───────────────────────────────
$router->post('/admin', 'App\\Modules\\Auth\\AuthController@processAdminLogin', [
    'App\\Middleware\\CsrfMiddleware',
]);

// ── GET /couple — Workspace Couple Login ─────────────────────────────────────
$router->get('/couple', 'App\\Modules\\Auth\\AuthController@showCoupleLogin');

// ── POST /couple — Process Workspace Couple Login ────────────────────────────
$router->post('/couple', 'App\\Modules\\Auth\\AuthController@processCoupleLogin', [
    'App\\Middleware\\CsrfMiddleware',
]);

// ── GET /login — Legacy redirect to /couple (302) ───────────────────────────
$router->get('/login', 'App\\Modules\\Auth\\AuthController@legacyLoginRedirect');

// ── POST /logout — Destroy session and redirect to /couple (AUTH-002) ─────────
// GET /logout is intentionally NOT registered. Logout must use POST only.
$router->post('/logout', 'App\\Modules\\Auth\\AuthController@logout', [
    'App\\Middleware\\CsrfMiddleware',
]);

// ── GET /forgot-password — Show forgot-password form (AUTH-003) ───────────────
$router->get('/forgot-password', 'App\\Modules\\Auth\\AuthController@showForgotPassword');

// ── POST /forgot-password — Request reset token (AUTH-003) ────────────────────
$router->post('/forgot-password', 'App\\Modules\\Auth\\AuthController@processForgotPassword', [
    'App\\Middleware\\CsrfMiddleware',
]);

// ── GET /reset-password/{token} — Show reset-password form (AUTH-003) ────────
$router->get('/reset-password/{token}', 'App\\Modules\\Auth\\AuthController@showResetPassword');

// ── POST /reset-password/{token} — Apply new password (AUTH-003) ─────────────
$router->post('/reset-password/{token}', 'App\\Modules\\Auth\\AuthController@processResetPassword', [
    'App\\Middleware\\CsrfMiddleware',
]);
