<?php

declare(strict_types=1);

use Apexl\Io\Product\Controller\ProductController;
use Apexl\Io\Product\Enum\permissions\ProductPermission;
use Apexl\Io\User\Middleware\RoutePermissionMiddleware;
use Slim\Routing\RouteCollectorProxy;

/**
 * Required from {@see Apexl\Io\Product\ProductModule::routes()}, so `$this` is
 * the module and its verb methods are in scope.
 *
 * `apiGroup('products', …)` supplies `/api/v{version}/products` — the paths the
 * 4.x line wrote out by hand. The version is the only part worth deriving rather
 * than writing, since it comes from config and changing it has to move every API
 * route at once.
 *
 * Reads and writes are gated differently, so the permission stays on each route
 * rather than on the group — the same split the 4.x line expressed with two
 * `serialize()`d route args.
 */

/** @var Apexl\Io\Product\ProductModule $this */

$view   = new RoutePermissionMiddleware(ProductPermission::CAN_VIEW_PRODUCTS);
$manage = new RoutePermissionMiddleware(ProductPermission::CAN_MANAGE_PRODUCTS);

$this->apiGroup('products', function (RouteCollectorProxy $routes) use ($view, $manage): void {
    /* The group's own path: `/api/v1/products`. Registered before `/{id}` — the
       order 4.x registered in, and static-before-variable hygiene. */
    $routes->get('', ProductController::class . '::index')
        ->setName('product.index')
        ->add($view);

    $routes->post('', ProductController::class . '::create')
        ->setName('product.create')
        ->add($manage);

    $routes->get('/{id}', ProductController::class . '::get')
        ->setName('product.get')
        ->add($view);

    $routes->put('/{id}', ProductController::class . '::update')
        ->setName('product.update')
        ->add($manage);

    $routes->delete('/{id}', ProductController::class . '::delete')
        ->setName('product.delete')
        ->add($manage);
});
