<?php

declare(strict_types=1);

use App\Http\Controllers\SettingController;
use App\Http\Controllers\UserController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| Administration — master users only
|--------------------------------------------------------------------------
|
| The `master` middleware guards the whole prefix. UserPolicy adds the
| record-level rules that middleware cannot express: you may not disable,
| reset or delete your own account, and you may not remove the last master.
| Settings has no policy — the middleware alone is the whole authorization
| story, the same reasoning already applied to master-data deletes.
|
*/

Route::middleware('master')->prefix('admin')->group(function (): void {
    Route::resource('users', UserController::class)->except(['show']);

    Route::patch('users/{user}/toggle-status', [UserController::class, 'toggleStatus'])
        ->name('users.toggle-status');

    Route::patch('users/{user}/reset-password', [UserController::class, 'resetPassword'])
        ->name('users.reset-password');

    Route::get('settings', [SettingController::class, 'index'])->name('settings.index');
    Route::put('settings', [SettingController::class, 'update'])->name('settings.update');
});
