<?php

use Illuminate\Support\Facades\Route;
use Modules\UserManagement\Http\Controllers\UserController;

// Platform users may use the module-level permission, while contractor
// administrators use the domain permission assigned to their role.
Route::middleware(['auth', 'verified', 'permission:users.access|manage users'])->group(function () {
    Route::resource('users', UserController::class);
    Route::patch('users/{user}/toggle-status', [UserController::class, 'toggleStatus'])->name('users.toggle-status');
    Route::patch('users/{user}/link-contractor', [UserController::class, 'linkContractor'])->name('users.link-contractor');

    // Bulk import
    Route::get('users-bulk-import', [UserController::class, 'bulkImportForm'])->name('users.bulk-import.form');
    Route::post('users-bulk-import', [UserController::class, 'bulkImport'])->name('users.bulk-import');
});

Route::middleware(['auth', 'verified'])->group(function () {
    // Forced password change (exempt from EnforcePasswordChange via route name check)
    Route::get('change-password', [UserController::class, 'changePasswordForm'])->name('password.change.form');
    Route::post('change-password', [UserController::class, 'changePassword'])->name('password.change.update');
});