<?php

use App\Http\Controllers\InstitutionController;
use App\Http\Controllers\InstitutionLinkController;
use Illuminate\Support\Facades\Route;

// Prefisso `api` e tier (`tier.app` / `tier.admin`) applicati dal loader in
// bootstrap/app.php. Le istituzioni si risolvono per `uuid` (route key del model).

// Lettura: utente pienamente operativo.
Route::middleware('tier.app')->group(function () {
    Route::apiResource('institutions', InstitutionController::class)->only(['index', 'show']);
    Route::apiResource('institutions.links', InstitutionLinkController::class)
        ->only(['index', 'show'])
        ->scoped();
});

// Scrittura + soft delete: solo Admin.
Route::middleware('tier.admin')->group(function () {
    Route::apiResource('institutions', InstitutionController::class)->only(['store', 'update', 'destroy']);

    // Soft delete: ripristino e cancellazione definitiva (binding sui cestinati).
    Route::post('institutions/{institution}/restore', [InstitutionController::class, 'restore'])->withTrashed();
    Route::delete('institutions/{institution}/force', [InstitutionController::class, 'forceDestroy'])->withTrashed();

    Route::apiResource('institutions.links', InstitutionLinkController::class)
        ->only(['store', 'update', 'destroy'])
        ->scoped();
});