<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\Api\AuthController;

/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider or bootstrap/app.php.
|
*/

// Authentication and onboarding (Public, but throttled)
Route::post('/register', [AuthController::class, 'register'])
    ->middleware(['idempotency', 'throttle.actions:otp_request']);

Route::post('/login', [AuthController::class, 'login'])
    ->middleware(['throttle.actions:login']);

Route::post('/otp/verify', [AuthController::class, 'verifyOtp'])
    ->middleware(['throttle.actions:login']);

// Authenticated Routes
Route::middleware(['auth.jwt', 'audit'])->group(function () {
    Route::post('/pin/setup', [AuthController::class, 'setupPin'])
        ->middleware(['idempotency']);
});