portal-api/routes/api.php

<?php

use App\Http\Controllers\Api\Admin\Auth\AuthController;
use App\Http\Controllers\Api\QueueMonitorController;
use App\Http\Controllers\Api\Admin\Staff\StaffOnlineController;
use App\Http\Controllers\Api\Admin\Customer\CustomerController;
use App\Http\Controllers\Api\Admin\Employee\EmployeeController;
use App\Http\Controllers\Api\Admin\Role\RolePermissionController;
use App\Http\Controllers\Api\Admin\Invoice\InvoiceController;
use App\Http\Controllers\Api\Admin\Order\OrderController;
use App\Http\Controllers\Api\Admin\Payment\PaymentController;
use App\Http\Controllers\Api\Admin\Product\ProductCategoryController;
use App\Http\Controllers\Api\Admin\Product\ProductController;
use App\Http\Controllers\Api\Admin\VPS\VPSController;
use App\Http\Controllers\Api\Admin\VCenter\VCenterController;
use App\Http\Controllers\Api\Admin\DnsManager\ServerController as DnsServerController;
use App\Http\Controllers\Api\Admin\DnsManager\DomainController as DnsDomainController;
use App\Http\Controllers\Api\Admin\OsManager\OsGroupController;
use App\Http\Controllers\Api\Admin\OsManager\OsController;
use App\Http\Services\Media;
use App\Http\Services\vCenter as ServiceVCenter;
use App\Models\ModuleVmware;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| is assigned the "api" middleware group. Enjoy building your API!
|
*/

Route::prefix('v1')
    /* Api for Admin */
    ->group(function () {
        Route::prefix('administrator')->group(function () {
            Route::post('login',   [AuthController::class, 'login']);

            Route::middleware('api.auth:admin')->group(function () {
                Route::post('logout',  [AuthController::class, 'logout']);
                Route::post('refresh', [AuthController::class, 'refresh']);
                Route::get('me',       [AuthController::class, 'me']);

                // Role Permissions
                Route::prefix('role-permissions')->group(function () {
                    // Accessible bởi mọi admin — trả về permissions hiệu lực của user hiện tại
                    Route::get('mine', [RolePermissionController::class, 'mine']);
                    // Các endpoint sau chỉ dành cho Full Administrator (kiểm tra trong controller)
                    Route::get('/', [RolePermissionController::class, 'index']);
                    Route::get('all-permissions', [RolePermissionController::class, 'allPermissions']);
                    Route::post('permissions', [RolePermissionController::class, 'createPermissionGroup']);
                    Route::delete('permissions/group/{module}', [RolePermissionController::class, 'deletePermissionGroup']);
                    Route::patch('permissions/{id}', [RolePermissionController::class, 'renamePermission']);
                    Route::put('{roleId}', [RolePermissionController::class, 'update']);
                });

                // Employees (module: administrator)
                Route::prefix('employees')->group(function () {
                    Route::get('roles', [EmployeeController::class, 'roles'])->middleware('perm:administrator.view');
                    Route::get('/', [EmployeeController::class, 'index'])->middleware('perm:administrator.view');
                    Route::post('/', [EmployeeController::class, 'store'])->middleware('perm:administrator.create');
                    Route::get('{id}', [EmployeeController::class, 'show'])->middleware('perm:administrator.view');
                    Route::put('{id}', [EmployeeController::class, 'update'])->middleware('perm:administrator.edit');
                    Route::delete('{id}', [EmployeeController::class, 'destroy'])->middleware('perm:administrator.destroy');
                });

                // Customers (module: customer)
                Route::prefix('customers')->group(function () {
                    Route::get('trash', [CustomerController::class, 'trash'])->middleware('perm:customer.view');
                    Route::get('/', [CustomerController::class, 'index'])->middleware('perm:customer.view');
                    Route::get('/datatable', [CustomerController::class, 'datatable'])->middleware('perm:customer.view');
                    Route::post('/', [CustomerController::class, 'store'])->middleware('perm:customer.create');
                    Route::get('{id}', [CustomerController::class, 'show'])->middleware('perm:customer.view');
                    Route::put('{id}', [CustomerController::class, 'update'])->middleware('perm:customer.edit');
                    Route::delete('{id}', [CustomerController::class, 'destroy'])->middleware('perm:customer.destroy');
                    Route::post('{id}/reset-password', [CustomerController::class, 'resetPassword'])->middleware('perm:customer.edit');
                    Route::post('{id}/add-credit', [CustomerController::class, 'addCredit'])->middleware('perm:customer.edit');
                    Route::get('{id}/products', [CustomerController::class, 'getProducts'])->middleware('perm:customer.view');
                    Route::get('{id}/invoices', [CustomerController::class, 'getInvoices'])->middleware('perm:customer.view');
                    Route::get('{id}/transactions', [CustomerController::class, 'getTransactions'])->middleware('perm:customer.view');
                    Route::get('{id}/domains', [CustomerController::class, 'getDomains'])->middleware('perm:customer.view');
                    Route::post('{id}/restore', [CustomerController::class, 'restore'])->middleware('perm:customer.edit');
                    Route::delete('{id}/force', [CustomerController::class, 'forceDelete'])->middleware('perm:customer.destroy');
                });

                // Products (module: product-service)
                Route::prefix('products')->group(function () {
                    Route::get('export', [ProductController::class, 'export'])->middleware('perm:product-service.manager');
                    Route::get('/',    [ProductController::class, 'index'])->middleware('perm:product-service.view');
                    Route::post('/',   [ProductController::class, 'store'])->middleware('perm:product-service.create');
                    Route::post('import', [ProductController::class, 'import'])->middleware('perm:product-service.create');
                    
                    // OS list for product configuration - must be before {id} routes
                    Route::get('os', [ProductController::class, 'getOsList'])->middleware('perm:product-service.view');
                    
                    Route::get('{id}', [ProductController::class, 'show'])->middleware('perm:product-service.view');
                    Route::get('{id}/os', [ProductController::class, 'getOs'])->middleware('perm:product-service.view');
                    Route::get('{id}/operating-systems', [ProductController::class, 'getOperatingSystems'])->middleware('perm:product-service.view');
                    Route::put('{id}', [ProductController::class, 'update'])->middleware('perm:product-service.edit');
                    Route::delete('{id}', [ProductController::class, 'destroy'])->middleware('perm:product-service.destroy');
                    Route::post('{id}/duplicate', [ProductController::class, 'duplicate'])->middleware('perm:product-service.create');
                });

                // Product Categories / Groups (module: product-service)
                Route::prefix('product-categories')
                    ->controller(ProductCategoryController::class)
                    ->as('product-categories.')
                    ->group(function () {
                        Route::get('/', 'index')->middleware('perm:product-service.view')->name('index');
                        Route::post('/', 'store')->middleware('perm:product-service.create')->name('store');
                        Route::get('{id}', 'show')->middleware('perm:product-service.view')->name('show');
                        Route::put('{id}', 'update')->middleware('perm:product-service.edit')->name('update');
                        Route::delete('{id}', 'destroy')->middleware('perm:product-service.destroy')->name('destroy');
                    });

                // Orders (module: order)
                Route::prefix('orders')->group(function () {
                    Route::get('/', [OrderController::class, 'index'])->middleware('perm:order.view');
                    Route::get('/datatable', [OrderController::class, 'datatable'])->middleware('perm:order.view');
                    Route::post('/upload-proof', [OrderController::class, 'uploadProof'])->middleware('perm:order.create');
                    Route::post('/', [OrderController::class, 'store'])->middleware('perm:order.create');
                    Route::get('{id}', [OrderController::class, 'show'])->middleware('perm:order.view');
                    Route::put('{id}', [OrderController::class, 'update'])->middleware('perm:order.edit');
                    Route::delete('{id}', [OrderController::class, 'destroy'])->middleware('perm:order.destroy');
                    Route::post('{id}/accept', [OrderController::class, 'accept'])->middleware('perm:order.edit');
                    Route::post('{id}/cancel', [OrderController::class, 'cancel'])->middleware('perm:order.edit');
                });

                // Invoices (module: invoice)
                Route::prefix('invoices')->group(function () {
                    Route::get('/', [InvoiceController::class, 'index'])->middleware('perm:invoice.view');
                    Route::get('/datatable', [InvoiceController::class, 'datatable'])->middleware('perm:invoice.view');
                    Route::post('/', [InvoiceController::class, 'store'])->middleware('perm:invoice.create');
                    Route::get('{id}', [InvoiceController::class, 'show'])->middleware('perm:invoice.view');
                    Route::put('{id}', [InvoiceController::class, 'update'])->middleware('perm:invoice.edit');
                    Route::delete('{id}', [InvoiceController::class, 'destroy'])->middleware('perm:invoice.destroy');
                    Route::post('{id}/paid', [InvoiceController::class, 'markAsPaid'])->middleware('perm:invoice.edit');
                    Route::post('{id}/cancel', [InvoiceController::class, 'cancel'])->middleware('perm:invoice.edit');
                    // Attachments
                    Route::get('{id}/attachments', [InvoiceController::class, 'listAttachments'])->middleware('perm:invoice.view');
                    Route::post('{id}/attachments', [InvoiceController::class, 'uploadAttachment'])->middleware('perm:invoice.edit');
                    Route::delete('{id}/attachments/{attachmentId}', [InvoiceController::class, 'deleteAttachment'])->middleware('perm:invoice.edit');
                    // Send mail notification
                    Route::post('{id}/send-mail', [InvoiceController::class, 'sendMail'])->middleware('perm:invoice.edit');
                });

                // Payments (module: payment)
                Route::prefix('payments')->group(function () {
                    Route::get('for-select', [PaymentController::class, 'forSelect']);
                    Route::get('/', [PaymentController::class, 'index'])->middleware('perm:payment.view');
                    Route::post('/', [PaymentController::class, 'store'])->middleware('perm:payment.create');
                    Route::get('{id}', [PaymentController::class, 'show'])->middleware('perm:payment.view');
                    Route::put('{id}', [PaymentController::class, 'update'])->middleware('perm:payment.edit');
                    Route::delete('{id}', [PaymentController::class, 'destroy'])->middleware('perm:payment.destroy');
                });

                // OS Groups & OS Entries (module: module-vcenter)
                Route::prefix('os-groups')
                    ->controller(OsGroupController::class)
                    ->as('os-groups.')
                    ->group(function () {
                        Route::get('/', 'index')->middleware('perm:module-vcenter.manager')->name('index');
                        Route::post('/', 'store')->middleware('perm:module-vcenter.manager')->name('store');
                        Route::get('{id}', 'show')->middleware('perm:module-vcenter.manager')->name('show');
                        Route::put('{id}', 'update')->middleware('perm:module-vcenter.manager')->name('update');
                        Route::delete('{id}', 'destroy')->middleware('perm:module-vcenter.manager')->name('destroy');
                    });

                Route::prefix('os')
                    ->controller(OsController::class)
                    ->as('os.')
                    ->group(function () {
                        Route::post('/', 'store')->middleware('perm:module-vcenter.manager')->name('store');
                        Route::put('{id}', 'update')->middleware('perm:module-vcenter.manager')->name('update');
                        Route::delete('{id}', 'destroy')->middleware('perm:module-vcenter.manager')->name('destroy');
                    });

                // VPS (module: module-vcenter)
                Route::prefix('vps')->group(function () {
                    Route::get('/', [VPSController::class, 'index'])->middleware('perm:module-vcenter.view');
                    Route::get('{id}', [VPSController::class, 'show'])->middleware('perm:module-vcenter.view');
                    Route::put('{id}', [VPSController::class, 'update'])->middleware('perm:module-vcenter.edit');
                    Route::post('{id}/power-on', [VPSController::class, 'powerOn'])->middleware('perm:module-vcenter.edit');
                    Route::post('{id}/power-off', [VPSController::class, 'powerOff'])->middleware('perm:module-vcenter.edit');
                    Route::post('{id}/restart', [VPSController::class, 'restart'])->middleware('perm:module-vcenter.edit');
                    Route::get('{id}/console-ticket', [VPSController::class, 'getConsoleTicket'])->middleware('perm:module-vcenter.view');
                });

                // vCenter (module: module-vcenter)
                Route::prefix('vcenter')->group(function () {
                    Route::get('tree', [VCenterController::class, 'tree'])->middleware('perm:module-vcenter.view');
                    Route::get('console-ticket', [VCenterController::class, 'consoleTicket'])->middleware('perm:module-vcenter.view');
                    Route::post('/', [VCenterController::class, 'store'])->middleware('perm:module-vcenter.create');
                    Route::post('sync', [VCenterController::class, 'sync'])->middleware('perm:module-vcenter.edit');
                    Route::put('node/{type}/{id}', [VCenterController::class, 'updateNode'])->middleware('perm:module-vcenter.edit');
                    Route::delete('node/{type}/{id}', [VCenterController::class, 'destroyNode'])->middleware('perm:module-vcenter.destroy');
                });

                // DNS Manager — Domains (module: domain.manager)
                Route::prefix('domains')->group(function () {
                    Route::get('/',    [DnsDomainController::class, 'index'])->middleware('perm:domain.manager');
                    Route::post('/',   [DnsDomainController::class, 'store'])->middleware('perm:domain.manager');
                    Route::get('{id}', [DnsDomainController::class, 'show'])->middleware('perm:domain.manager');
                    Route::put('{id}', [DnsDomainController::class, 'update'])->middleware('perm:domain.manager');
                    Route::delete('{id}', [DnsDomainController::class, 'destroy'])->middleware('perm:domain.manager');
                    // DNS Records
                    Route::get('{id}/dns',           [DnsDomainController::class, 'dnsIndex'])->middleware('perm:domain.manager');
                    Route::post('{id}/dns',          [DnsDomainController::class, 'dnsStore'])->middleware('perm:domain.manager');
                    Route::put('{id}/dns/{recordId}', [DnsDomainController::class, 'dnsUpdate'])->middleware('perm:domain.manager');
                    Route::delete('{id}/dns/{recordId}', [DnsDomainController::class, 'dnsDestroy'])->middleware('perm:domain.manager');
                });

                // DNS Manager — Servers (module: domain.manager)
                Route::prefix('dns-servers')->group(function () {
                    Route::get('/',    [DnsServerController::class, 'index'])->middleware('perm:domain.manager');
                    Route::post('/',   [DnsServerController::class, 'store'])->middleware('perm:domain.manager');
                    Route::get('{id}', [DnsServerController::class, 'show'])->middleware('perm:domain.manager');
                    Route::put('{id}', [DnsServerController::class, 'update'])->middleware('perm:domain.manager');
                    Route::delete('{id}', [DnsServerController::class, 'destroy'])->middleware('perm:domain.manager');
                });

                // Staff Online
                Route::prefix('staff-online')->group(function () {
                    Route::get('/', [StaffOnlineController::class, 'index']);
                    Route::post('ping', [StaffOnlineController::class, 'ping']);
                });

                // Queue Monitor (Horizon)
                Route::prefix('queue')->group(function () {
                    Route::get('jobs/recent',  [QueueMonitorController::class, 'recent']);
                    Route::get('jobs/pending', [QueueMonitorController::class, 'pending']);
                    Route::get('jobs/failed',  [QueueMonitorController::class, 'failed']);
                    Route::get('jobs/metrics', [QueueMonitorController::class, 'metrics']);
                });

                // vCenter Manager Power Operations (module: module-vcenter)
                Route::prefix('vcenter-manager')->group(function () {
                    Route::post('vm/power-on', [App\Http\Controllers\admin\VCenterManagerController::class, 'powerOn'])->middleware('perm:module-vcenter.edit');
                    Route::post('vm/power-off', [App\Http\Controllers\admin\VCenterManagerController::class, 'powerOff'])->middleware('perm:module-vcenter.edit');
                    Route::get('vms/powered-off', [App\Http\Controllers\admin\VCenterManagerController::class, 'getPoweredOffVms'])->middleware('perm:module-vcenter.view');
                });
            });
        });

        Route::prefix('system')->middleware(['api.auth'])->group(function () {

            Route::post('get-all-image', function (Media $media) {
                $files = $media->getAllMedia();
                return response()->json(['data' => $files]);
            })->name('api.GetAllImage');


            Route::get('get-ticket-console', function (Request $request, ServiceVCenter $serviceVCenter) {
                $product_id = $request->get('product');
                if (!$product_id) {
                    return response()->json(['error' => true, 'message' => "Please choose product"]);
                }
                $product = ModuleVmware::with('ipAddress.host.datacenter.vCenter')->find($product_id);
                if (!$product) {
                    return response()->json(['error' => true, 'message' => "Can't find product"]);
                }

                $vcenter = null;
                if ($product->ipAddress && $product->ipAddress->host && $product->ipAddress->host->datacenter && $product->ipAddress->host->datacenter->vCenter) {
                    $vcenter = $product->ipAddress->host->datacenter->vCenter;
                }

                if (!$vcenter) {
                    return response()->json(['error' => true, 'message' => "Can't find vCenter information"]);
                }

                // Đăng nhập vCenter trước khi lấy ticket
                if (!$serviceVCenter->loginServer($vcenter)) {
                    return response()->json([
                        'error' => true,
                        'message' => 'Không thể đăng nhập vào vCenter'
                    ]);
                }

                $ConsoleTicket = $serviceVCenter->GetConsoleTickets($product->vmware_id);

                // Nếu login hết hạn, thử login lại 1 lần nữa
                if ($ConsoleTicket === 'Login_Again') {
                    if ($serviceVCenter->loginServer($vcenter)) {
                        $ConsoleTicket = $serviceVCenter->GetConsoleTickets($product->vmware_id);
                    } else {
                        return response()->json([
                            'error' => true,
                            'message' => 'Không thể đăng nhập lại vào vCenter'
                        ]);
                    }
                }

                // Nếu vẫn lỗi, trả về lỗi rõ ràng
                if (is_string($ConsoleTicket)) {
                    return response()->json([
                        'error' => true,
                        'message' => "Failed to get console ticket: $ConsoleTicket"
                    ]);
                }

                if ($ConsoleTicket['error']) {
                    return response()->json([
                        'error' => true,
                        'message' => $ConsoleTicket['data']
                    ]);
                }

                return response()->json([
                    'error' => false,
                    'data' => $ConsoleTicket['data'],
                    'host' => $vcenter->host,
                    'vmware-api-session-id' => $serviceVCenter->token
                ])->cookie('vmware-api-session-id', $serviceVCenter->token, 60, '/', null, false, false);
            })->name('api.GetConsoleTicket');
        });
    });

Route::any('{any}', function () {
    return response()->json([
        'error' => true,
        'message' => 'API Route not found'
    ], 404);
})->where('any', '.*');