<?php

use App\Http\Controllers\OperatorController;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| B2B Operator / Casino Integration Routes
|--------------------------------------------------------------------------
|
| These routes are loaded without the /api prefix by bootstrap/app.php,
| so they are available at /operator/* as documented.
|
| All routes are protected by the license.key middleware which:
|   - Reads X-License-Key header OR license_key body/query field
|   - Hashes the key and looks it up in operator_casinos
|   - Checks the casino is active
|   - Enforces IP whitelist if configured
|   - Binds the OperatorCasino instance as $request->attributes->get('operator_casino')
|
*/

Route::middleware(['license.key'])->group(function () {

    // Game catalog — list all available games with metadata
    Route::get('/games', [OperatorController::class, 'games'])
        ->middleware('throttle:120,1')
        ->name('operator.games');

    // Launch a game session for a player — returns launch_url + session_token
    Route::post('/launch', [OperatorController::class, 'launch'])
        ->middleware('throttle:30,1')
        ->name('operator.launch');

    // Query the current / final state of a session (balance delta, status)
    Route::get('/session/{token}', [OperatorController::class, 'session'])
        ->middleware('throttle:120,1')
        ->where('token', '[0-9a-f\-]{36}')
        ->name('operator.session');
});