<?php

/**
 * TPIN module routes.
 * Profile self-service is auth-only; admin assign/clear use tpin.* permissions.
 * Verify/status endpoints are reusable hooks for future tasks (not wired yet).
 *
 * @var \CodeIgniter\Router\RouteCollection $routes
 */
$routes->group('', ['filter' => 'auth'], static function ($routes) {
    $routes->get('profile/tpin', '\Modules\Tpin\Controllers\TpinController::manageForm');
    $routes->post('profile/tpin/set', '\Modules\Tpin\Controllers\TpinController::setSubmit');
    $routes->post('profile/tpin/change', '\Modules\Tpin\Controllers\TpinController::changeSubmit');
    $routes->post('profile/tpin/clear', '\Modules\Tpin\Controllers\TpinController::clearOwnSubmit');

    $routes->get('tpin/status', '\Modules\Tpin\Controllers\TpinController::status');
    $routes->post('tpin/verify', '\Modules\Tpin\Controllers\TpinController::verify');

    $routes->post('users/(:num)/tpin-required', '\Modules\Tpin\Controllers\TpinController::assignRequired/$1', [
        'filter' => 'permission:tpin.assign',
    ]);
    $routes->post('users/(:num)/tpin-clear', '\Modules\Tpin\Controllers\TpinController::adminClear/$1', [
        'filter' => 'permission:tpin.clear',
    ]);
});
