69 lines
3.1 KiB
PHP
69 lines
3.1 KiB
PHP
<?php
|
|
|
|
use App\Enums\RoleName;
|
|
use App\Http\Controllers\Auth\AuthController;
|
|
use App\Http\Controllers\BusinessTypeController;
|
|
use App\Http\Controllers\OnboardingController;
|
|
use App\Http\Controllers\PlanController;
|
|
use App\Http\Controllers\TenantController;
|
|
use App\Http\Controllers\UserController;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
Route::prefix('v1')->middleware(['force.json', 'api.version:v1'])->group(function () {
|
|
Route::prefix('auth')->group(function () {
|
|
Route::post('/register', [AuthController::class, 'register'])->middleware('rate.limit:register,5,1');
|
|
Route::post('/login', [AuthController::class, 'login'])->middleware('rate.limit:login,5,1');
|
|
|
|
Route::prefix('sso')->group(function () {
|
|
Route::post('/handoff', [AuthController::class, 'ssoHandoff'])->middleware('auth:sanctum');
|
|
Route::post('/exchange', [AuthController::class, 'ssoExchange'])->middleware('rate.limit:sso-exchange,10,1');
|
|
});
|
|
|
|
// `web` gives these two a session/cookie so Socialite can validate its
|
|
// `state` CSRF parameter across the redirect to Google and back — the
|
|
// only routes in this API that aren't fully stateless, deliberately.
|
|
Route::prefix('google')->middleware('web')->group(function () {
|
|
Route::get('/redirect', [AuthController::class, 'googleRedirect'])->middleware('rate.limit:google-auth,10,1');
|
|
Route::get('/callback', [AuthController::class, 'googleCallback'])->middleware('rate.limit:google-auth,10,1');
|
|
});
|
|
});
|
|
|
|
Route::get('/user', function (Request $request) {
|
|
return $request->user();
|
|
})->middleware('auth:sanctum');
|
|
|
|
Route::post('onboarding', [OnboardingController::class, 'store'])
|
|
->middleware(['auth:sanctum', 'rate.limit:onboarding,3,1']);
|
|
|
|
Route::middleware(['auth:sanctum', 'role:developer,super-admin,admin,marketing,user'])->group(function () {
|
|
Route::get('business-types', [BusinessTypeController::class, 'index']);
|
|
Route::get('plans', [PlanController::class, 'index']);
|
|
});
|
|
|
|
// Admin master data — every role except the plain `user` (customer) role.
|
|
$adminRoles = implode(',', array_diff(RoleName::values(), [RoleName::User->value]));
|
|
|
|
Route::middleware(['auth:sanctum', "role:{$adminRoles}"])->group(function () {
|
|
Route::apiResource('business-types', BusinessTypeController::class)->except('index')->parameters([
|
|
'business-types' => 'id',
|
|
]);
|
|
|
|
Route::apiResource('plans', PlanController::class)->except('index')->parameters([
|
|
'plans' => 'id',
|
|
]);
|
|
|
|
Route::apiResource('users', UserController::class)->parameters([
|
|
'users' => 'id',
|
|
]);
|
|
Route::post('users/{id}/reset-password', [UserController::class, 'resetPassword']);
|
|
|
|
Route::apiResource('tenants', TenantController::class)->except('store')->parameters([
|
|
'tenants' => 'id',
|
|
]);
|
|
});
|
|
|
|
// Domain modules own their routes — app/Domains/{Domain}/routes.php.
|
|
require app_path('Domains/Barbershop/routes.php');
|
|
});
|