autocrm/routes/api.php

<?php

use App\Http\Controllers\Api\ApiAuthController;
use App\Http\Controllers\Api\ClientApiController;
use App\Http\Controllers\Api\MechanicApiController;
use App\Http\Controllers\Api\RoleApiController;
use App\Http\Controllers\Api\UserApiController;
use App\Http\Controllers\Api\VehicleApiController;
use App\Http\Controllers\Api\WorkOrderApiController;
use App\Http\Controllers\TrackingController;
use Illuminate\Support\Facades\Route;

// Public tracking JSON (no auth)
Route::get('/track/{token}', [TrackingController::class, 'jsonStatus'])
    ->where('token', '[A-Za-z0-9]{16,32}')
    ->name('api.tracking.json');

// Laravel 12 auto-prefixes routes/api.php with /api → routes here become /api/v1/...
Route::prefix('v1')->group(function () {
    Route::post('/login', [ApiAuthController::class, 'login']);

    Route::middleware(['auth:sanctum', \App\Http\Middleware\EnsureTokenMatchesTenant::class])->group(function () {
        Route::get('/me', [ApiAuthController::class, 'me']);
        Route::post('/logout', [ApiAuthController::class, 'logout']);

        Route::apiResource('clients', ClientApiController::class);
        Route::apiResource('vehicles', VehicleApiController::class);
        Route::apiResource('work-orders', WorkOrderApiController::class);

        // RBAC management — guarded by ADMIN_USERS_* / ADMIN_ROLES_MANAGE.
        Route::apiResource('users', UserApiController::class);
        Route::post('users/{user}/activate', [UserApiController::class, 'activate']);
        Route::post('users/{user}/deactivate', [UserApiController::class, 'deactivate']);
        Route::post('users/{user}/resend-invitation', [UserApiController::class, 'resendInvitation']);
        Route::post('users/{user}/force-password-reset', [UserApiController::class, 'forcePasswordReset']);
        Route::get('users/{user}/sessions', [UserApiController::class, 'sessions']);
        Route::delete('users/{user}/sessions', [UserApiController::class, 'revokeAllSessions']);
        Route::delete('users/{user}/sessions/{sessionId}', [UserApiController::class, 'revokeSession']);
        Route::get('users/{user}/roles', [UserApiController::class, 'roles']);
        Route::post('users/{user}/roles', [UserApiController::class, 'assignRole']);
        Route::delete('users/{user}/roles/{role}', [UserApiController::class, 'removeRole']);
        Route::get('users/{user}/permissions', [UserApiController::class, 'permissions']);
        Route::post('users/{user}/permission-overrides', [UserApiController::class, 'addOverride']);
        Route::delete('users/{user}/permission-overrides/{permission}', [UserApiController::class, 'removeOverride']);

        Route::apiResource('roles', RoleApiController::class);
        Route::get('roles/{role}/permissions', [RoleApiController::class, 'permissions']);
        Route::put('roles/{role}/permissions', [RoleApiController::class, 'syncPermissions']);
        Route::get('permissions', [RoleApiController::class, 'permissionCatalog']);

        // M13 — mechanic-scoped board + KPI
        Route::get('mechanic/board', [MechanicApiController::class, 'board']);
        Route::get('mechanic/kpi', [MechanicApiController::class, 'kpi']);
        Route::post('mechanic/tasks/{work}/start', [MechanicApiController::class, 'startTask']);
        Route::post('mechanic/tasks/{work}/pause', [MechanicApiController::class, 'pauseTask']);
        Route::post('mechanic/tasks/{work}/resume', [MechanicApiController::class, 'resumeTask']);
        Route::post('mechanic/tasks/{work}/done', [MechanicApiController::class, 'doneTask']);
        Route::post('mechanic/tasks/{work}/block', [MechanicApiController::class, 'blockTask']);
    });
});