<?php
declare(strict_types=1);

// PHP built-in server: serve real files directly
if (PHP_SAPI === 'cli-server') {
    $file = __DIR__ . parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
    if (is_file($file)) return false;
}

require dirname(__DIR__) . '/app/bootstrap.php';

use App\Controllers as C;
use App\Controllers\Admin as A;
use App\Core\Installer;
use App\Core\Router;

// ---------- First run: automatic installation ----------
if (!Installer::isInstalled()) {
    (new C\InstallController())->handle();
    exit;
}

// ---------- Maintenance mode (staff can still browse) ----------
if (setting('maintenance_mode') === '1' && !App\Core\Auth::isStaff() && !preg_match('#^/(ingia|admin|toka)#', current_path())) {
    http_response_code(503);
    App\Core\View::render('errors/maintenance', ['title' => t('errors.maintenance')]);
    exit;
}

$r = new Router();

// Public
$r->get('/', [C\HomeController::class, 'index']);
$r->get('/tafuta', [C\SearchController::class, 'index']);
$r->get('/kupangisha', [C\SearchController::class, 'rent']);
$r->get('/bnb', [C\SearchController::class, 'bnb']);
$r->get('/inauzwa', [C\SearchController::class, 'sale']);
$r->get('/viwanja', [C\SearchController::class, 'land']);
$r->get('/mashamba', [C\SearchController::class, 'farms']);
$r->get('/kategoria/{slug}', [C\SearchController::class, 'category']);
$r->get('/mkoa/{slug}', [C\SearchController::class, 'region']);
$r->get('/ramani', [C\SearchController::class, 'map']);
$r->get('/api/ramani', [C\SearchController::class, 'markers']);
$r->get('/api/maeneo', [C\SearchController::class, 'locations']);
$r->get('/linganisha', [C\SearchController::class, 'compare']);

$r->get('/mali/{code}', [C\ListingController::class, 'show']);
$r->post('/mali/{code}/simu', [C\ListingController::class, 'revealPhone']);
$r->post('/mali/{code}/whatsapp', [C\ListingController::class, 'whatsapp']);
$r->post('/mali/{code}/ujumbe', [C\ListingController::class, 'message'], ['auth']);
$r->post('/mali/{code}/kuona', [C\ListingController::class, 'viewing'], ['auth']);
$r->post('/mali/{code}/booking', [C\ListingController::class, 'booking'], ['auth']);
$r->post('/mali/{code}/hifadhi', [C\ListingController::class, 'favourite'], ['auth']);
$r->post('/mali/{code}/ripoti', [C\ListingController::class, 'report']);
$r->post('/mali/{code}/tathmini', [C\ListingController::class, 'review'], ['auth']);
$r->post('/mali/{code}/deposit', [C\ListingController::class, 'reserve'], ['auth']);

$r->get('/mawakala', [C\AgentController::class, 'index']);
$r->get('/wakala/{slug}', [C\AgentController::class, 'show']);
$r->get('/huduma', [C\PageController::class, 'services']);
$r->post('/huduma/omba', [C\PageController::class, 'serviceRequest']);
$r->get('/ofisi', [C\PageController::class, 'offices']);
$r->get('/fuatilia', [C\PageController::class, 'tracker']);
$r->get('/maswali', [C\PageController::class, 'faq']);
$r->get('/wasiliana', [C\PageController::class, 'contact']);
$r->post('/wasiliana', [C\PageController::class, 'contactSend']);
$r->get('/diaspora', [C\PageController::class, 'diaspora']);
$r->get('/ukurasa/{slug}', [C\PageController::class, 'page']);
$r->get('/weka-tangazo', [C\PageController::class, 'postListing']);
$r->get('/jiunge', [C\PageController::class, 'plans']);
$r->post('/arifa', [C\NewsletterController::class, 'store']);
$r->get('/sitemap.xml', [C\PageController::class, 'sitemap']);
$r->get('/robots.txt', [C\PageController::class, 'robots']);

// Auth
$r->get('/ingia', [C\AuthController::class, 'loginForm'], ['guest']);
$r->post('/ingia', [C\AuthController::class, 'login'], ['guest']);
$r->get('/jisajili', [C\AuthController::class, 'registerForm'], ['guest']);
$r->post('/jisajili', [C\AuthController::class, 'register'], ['guest']);
$r->get('/thibitisha', [C\AuthController::class, 'verifyForm'], ['auth']);
$r->post('/thibitisha', [C\AuthController::class, 'verify'], ['auth']);
$r->post('/thibitisha/tuma-tena', [C\AuthController::class, 'resend'], ['auth']);
$r->get('/umesahau', [C\AuthController::class, 'forgotForm'], ['guest']);
$r->post('/umesahau', [C\AuthController::class, 'forgot'], ['guest']);
$r->get('/weka-upya', [C\AuthController::class, 'resetForm'], ['guest']);
$r->post('/weka-upya', [C\AuthController::class, 'reset'], ['guest']);
$r->post('/toka', [C\AuthController::class, 'logout']);

// Account (all logged-in users)
$r->get('/akaunti', [C\AccountController::class, 'dashboard'], ['auth']);
$r->get('/akaunti/wasifu', [C\AccountController::class, 'profile'], ['auth']);
$r->post('/akaunti/wasifu', [C\AccountController::class, 'saveProfile'], ['auth']);
$r->post('/akaunti/password', [C\AccountController::class, 'password'], ['auth']);
$r->post('/akaunti/jukumu', [C\AccountController::class, 'addRole'], ['auth']);
$r->get('/akaunti/uthibitisho', [C\AccountController::class, 'verification'], ['auth']);
$r->post('/akaunti/uthibitisho', [C\AccountController::class, 'submitVerification'], ['auth']);
$r->get('/akaunti/vipendwa', [C\AccountController::class, 'favourites'], ['auth']);
$r->get('/akaunti/utafutaji', [C\AccountController::class, 'savedSearches'], ['auth']);
$r->post('/akaunti/utafutaji', [C\AccountController::class, 'saveSearch'], ['auth']);
$r->post('/akaunti/utafutaji/{id}/futa', [C\AccountController::class, 'deleteSearch'], ['auth']);
$r->get('/akaunti/arifa', [C\AccountController::class, 'notifications'], ['auth']);
$r->post('/akaunti/futa-akaunti', [C\AccountController::class, 'deleteAccount'], ['auth']);
$r->get('/akaunti/data', [C\AccountController::class, 'exportData'], ['auth']);

$r->get('/akaunti/ujumbe', [C\InboxController::class, 'index'], ['auth']);
$r->get('/akaunti/ujumbe/{id}', [C\InboxController::class, 'show'], ['auth']);
$r->post('/akaunti/ujumbe/{id}', [C\InboxController::class, 'reply'], ['auth']);

$r->get('/akaunti/maombi', [C\RequestsController::class, 'viewings'], ['auth']);
$r->post('/akaunti/maombi/{id}', [C\RequestsController::class, 'updateViewing'], ['auth']);
$r->get('/akaunti/booking', [C\RequestsController::class, 'bookings'], ['auth']);
$r->post('/akaunti/booking/{id}', [C\RequestsController::class, 'updateBooking'], ['auth']);
$r->get('/akaunti/leads', [C\RequestsController::class, 'leads'], ['auth']);
$r->post('/akaunti/leads/{id}', [C\RequestsController::class, 'updateLead'], ['auth']);
$r->get('/akaunti/muamala', [C\RequestsController::class, 'deals'], ['auth']);
$r->post('/akaunti/muamala/{id}', [C\RequestsController::class, 'advanceDeal'], ['auth']);

$r->get('/akaunti/matangazo', [C\MyListingsController::class, 'index'], ['auth']);
$r->get('/akaunti/matangazo/mpya', [C\MyListingsController::class, 'create'], ['auth']);
$r->post('/akaunti/matangazo/mpya', [C\MyListingsController::class, 'store'], ['auth']);
$r->get('/akaunti/matangazo/{id}', [C\MyListingsController::class, 'edit'], ['auth']);
$r->post('/akaunti/matangazo/{id}', [C\MyListingsController::class, 'update'], ['auth']);
$r->post('/akaunti/matangazo/{id}/hali', [C\MyListingsController::class, 'status'], ['auth']);
$r->post('/akaunti/matangazo/{id}/futa', [C\MyListingsController::class, 'destroy'], ['auth']);
$r->post('/akaunti/matangazo/{id}/media', [C\MyListingsController::class, 'uploadMedia'], ['auth']);
$r->post('/akaunti/matangazo/{id}/media/{mid}/futa', [C\MyListingsController::class, 'deleteMedia'], ['auth']);
$r->post('/akaunti/matangazo/{id}/media/panga', [C\MyListingsController::class, 'sortMedia'], ['auth']);
$r->post('/akaunti/matangazo/{id}/kalenda', [C\MyListingsController::class, 'calendar'], ['auth']);

$r->get('/akaunti/malipo', [C\PaymentController::class, 'index'], ['auth']);
$r->post('/akaunti/malipo/anza', [C\PaymentController::class, 'start'], ['auth']);
$r->get('/akaunti/malipo/{ref}', [C\PaymentController::class, 'show'], ['auth']);
$r->post('/akaunti/malipo/{ref}', [C\PaymentController::class, 'submit'], ['auth']);

$r->get('/akaunti/timu', [C\AccountController::class, 'team'], ['auth', 'perm:agency.team']);
$r->post('/akaunti/timu', [C\AccountController::class, 'addMember'], ['auth', 'perm:agency.team']);
$r->post('/akaunti/timu/{id}/ondoa', [C\AccountController::class, 'removeMember'], ['auth', 'perm:agency.team']);

// Private documents (owner or verifier only)
$r->get('/hati/{id}/{which}', [C\AccountController::class, 'document'], ['auth']);

// ---------- Admin ----------
$adm = ['perm:admin.access'];
$r->get('/admin', [A\DashboardController::class, 'index'], $adm);

$r->get('/admin/matangazo', [A\ListingsController::class, 'index'], ['perm:listings.moderate']);
$r->get('/admin/matangazo/{id}', [A\ListingsController::class, 'show'], ['perm:listings.moderate']);
$r->post('/admin/matangazo/{id}/hatua', [A\ListingsController::class, 'action'], ['perm:listings.moderate']);
$r->post('/admin/matangazo/kwa-pamoja', [A\ListingsController::class, 'bulk'], ['perm:listings.moderate']);

$r->get('/admin/watumiaji', [A\UsersController::class, 'index'], ['perm:users.view']);
$r->get('/admin/watumiaji/mpya', [A\UsersController::class, 'create'], ['perm:users.manage']);
$r->post('/admin/watumiaji/mpya', [A\UsersController::class, 'store'], ['perm:users.manage']);
$r->get('/admin/watumiaji/{id}', [A\UsersController::class, 'show'], ['perm:users.view']);
$r->post('/admin/watumiaji/{id}', [A\UsersController::class, 'update'], ['perm:users.manage']);
$r->post('/admin/watumiaji/{id}/kuingia-kama', [A\UsersController::class, 'impersonate'], ['perm:users.roles']);

$r->get('/admin/uthibitisho', [A\TrustController::class, 'verifications'], ['perm:verifications.review']);
$r->post('/admin/uthibitisho/{id}', [A\TrustController::class, 'decideVerification'], ['perm:verifications.review']);
$r->get('/admin/ripoti', [A\TrustController::class, 'reports'], ['perm:reports.handle']);
$r->post('/admin/ripoti/{id}', [A\TrustController::class, 'updateReport'], ['perm:reports.handle']);
$r->get('/admin/tathmini', [A\TrustController::class, 'reviews'], ['perm:reviews.moderate']);
$r->post('/admin/tathmini/{id}', [A\TrustController::class, 'updateReview'], ['perm:reviews.moderate']);

$r->get('/admin/malipo', [A\MoneyController::class, 'payments'], ['perm:payments.view']);
$r->post('/admin/malipo/{id}', [A\MoneyController::class, 'updatePayment'], ['perm:payments.manage']);
$r->get('/admin/booking', [A\MoneyController::class, 'bookings'], ['perm:bookings.view']);
$r->get('/admin/muamala', [A\MoneyController::class, 'deals'], ['perm:deals.manage']);
$r->post('/admin/muamala/{id}', [A\MoneyController::class, 'updateDeal'], ['perm:deals.manage']);
$r->get('/admin/leads', [A\MoneyController::class, 'leads'], ['perm:bookings.view']);

$r->get('/admin/sections', [A\SectionsController::class, 'index'], ['perm:content.manage']);
$r->post('/admin/sections/panga', [A\SectionsController::class, 'sort'], ['perm:content.manage']);
$r->post('/admin/sections/mpya', [A\SectionsController::class, 'store'], ['perm:content.manage']);
$r->get('/admin/sections/{id}', [A\SectionsController::class, 'edit'], ['perm:content.manage']);
$r->post('/admin/sections/{id}', [A\SectionsController::class, 'update'], ['perm:content.manage']);
$r->post('/admin/sections/{id}/washa', [A\SectionsController::class, 'toggle'], ['perm:content.manage']);
$r->post('/admin/sections/{id}/nakili', [A\SectionsController::class, 'duplicate'], ['perm:content.manage']);
$r->post('/admin/sections/{id}/futa', [A\SectionsController::class, 'destroy'], ['perm:content.manage']);

$r->get('/admin/mipangilio', [A\SettingsController::class, 'index'], ['perm:settings.manage']);
$r->post('/admin/mipangilio', [A\SettingsController::class, 'save'], ['perm:settings.manage']);
$r->post('/admin/mipangilio/sms-jaribio', [A\SettingsController::class, 'testSms'], ['perm:settings.manage']);
$r->get('/admin/muonekano', [A\SettingsController::class, 'appearance'], ['perm:appearance.manage']);
$r->post('/admin/muonekano', [A\SettingsController::class, 'saveAppearance'], ['perm:appearance.manage']);
$r->get('/admin/tafsiri', [A\SettingsController::class, 'translations'], ['perm:translations.manage']);
$r->post('/admin/tafsiri', [A\SettingsController::class, 'saveTranslations'], ['perm:translations.manage']);
$r->get('/admin/ruhusa', [A\SettingsController::class, 'permissions'], ['perm:roles.manage']);
$r->post('/admin/ruhusa', [A\SettingsController::class, 'savePermissions'], ['perm:roles.manage']);
$r->get('/admin/zana', [A\SettingsController::class, 'tools'], ['perm:settings.manage']);
$r->post('/admin/zana', [A\SettingsController::class, 'runTool'], ['perm:settings.manage']);
$r->get('/admin/audit', [A\SettingsController::class, 'audit'], ['perm:audit.view']);

$r->get('/admin/media', [A\MediaController::class, 'index'], ['perm:media.manage']);
$r->post('/admin/media', [A\MediaController::class, 'upload'], ['perm:media.manage']);
$r->post('/admin/media/{id}/futa', [A\MediaController::class, 'destroy'], ['perm:media.manage']);
$r->get('/admin/api/media', [A\MediaController::class, 'picker'], ['perm:admin.access']);

$r->get('/admin/maeneo/ingiza', [A\CrudController::class, 'importForm'], ['perm:locations.manage']);
$r->post('/admin/maeneo/ingiza', [A\CrudController::class, 'import'], ['perm:locations.manage']);
$r->get('/admin/data/{res}', [A\CrudController::class, 'index'], $adm);
$r->get('/admin/data/{res}/csv', [A\CrudController::class, 'csv'], $adm);
$r->get('/admin/data/{res}/mpya', [A\CrudController::class, 'create'], $adm);
$r->post('/admin/data/{res}/mpya', [A\CrudController::class, 'store'], $adm);
$r->get('/admin/data/{res}/{id}', [A\CrudController::class, 'edit'], $adm);
$r->post('/admin/data/{res}/{id}', [A\CrudController::class, 'update'], $adm);
$r->post('/admin/data/{res}/{id}/futa', [A\CrudController::class, 'destroy'], $adm);

$r->dispatch($_SERVER['REQUEST_METHOD'] ?? 'GET', $_SERVER['REQUEST_URI'] ?? '/');