<?php

use App\Http\Controllers\Api\ProductReviewController;
use App\Http\Controllers\Api\RazorpayWebhookController;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::get('/user', function (Request $request) {
    return $request->user();
})->middleware('auth:sanctum');

// Razorpay webhook: must be reachable from the internet. Configure this exact URL in Razorpay Dashboard
// (Webhooks). Webhook Secret in Dashboard must match payment_razorpay_webhook_secret in Settings.
Route::post('/webhooks/razorpay', [RazorpayWebhookController::class, 'handle'])
    ->middleware(['verify.razorpay.signature', 'throttle:30,1'])
    ->name('api.webhooks.razorpay');

// Ekart webhook endpoint (manual setup in Ekart portal)
Route::post('/webhooks/ekart', [\App\Http\Controllers\Api\EkartWebhookController::class, 'handle'])
    ->middleware(['verify.ekart.signature', 'throttle:20,1'])
    ->name('api.webhooks.ekart');

// Product Reviews API (Public endpoints only - creation/update moved to web.php for session auth)
Route::prefix('products')->group(function () {
    // Public: Get reviews for a product (no auth required)
    Route::get('/{id}/reviews', [ProductReviewController::class, 'index'])->name('api.products.reviews.index');
});

// Note: POS API routes moved to web.php for session-based authentication