# Route Map — ERP Gudang

Source: `routes/web.php`, `routes/api.php`, `routes/console.php`.
Convention: routes map to Go `/api/v1/...` (Phase 3 openapi.yaml defines the final contract).

Route groups and their middleware roles (Laravel `role:` = RoleMiddleware allow-list; admin bypasses):

- Controller constructor `middleware(['auth','active',...])` applies to every method.

---

## A. Auth (web/session) — do NOT expose as API endpoints (API auth is bearer-token based)

| Method | Path | Controller @method |
|---|---|---|
| GET | `/login` | Auth\AuthController@showLogin |
| POST | `/login` | Auth\AuthController@login |
| POST | `/logout` | Auth\AuthController@logout |

## B. Existing API routes (`routes/api.php`) → migrate to `/api/v1`

| Method | Path (today) | Auth | Go candidate |
|---|---|---|---|
| POST | `/api/login` | public | `POST /api/v1/auth/login` |
| GET | `/api/me` | sanctum | `GET /api/v1/auth/me` |
| POST | `/api/logout` | sanctum | `POST /api/v1/auth/logout` |
| GET | `/api/dashboard/kpis` | sanctum | `GET /api/v1/dashboard/kpis` |
| POST | `/api/hr/clock-in` | sanctum | `POST /api/v1/hr/attendance/clock-in` |
| POST | `/api/hr/clock-out` | sanctum | `POST /api/v1/hr/attendance/clock-out` |
| POST | `/api/hr/leaves` | sanctum | `POST /api/v1/hr/leaves` |
| GET | `/api/hr/my-attendance` | sanctum | `GET /api/v1/hr/attendance/me` |
| GET | `/api/hr/my-payslips` | sanctum | `GET /api/v1/hr/payslips/me` |
| GET | `/api/hr/my-leaves` | sanctum | `GET /api/v1/hr/leaves/me` |
| POST | `/api/tracking/location` | sanctum | `POST /api/v1/sales-tracking/locations/ping` |
| POST | `/api/tracking/visits/{visit}/checkin` | sanctum | `POST /api/v1/sales-tracking/visits/{id}/checkin` |
| POST | `/api/tracking/visits/{visit}/checkout` | sanctum | `POST /api/v1/sales-tracking/visits/{id}/checkout` |
| GET | `/api/tracking/my-visits` | sanctum | `GET /api/v1/sales-tracking/visits/me` |
| GET | `/api/tracking/my-route` | sanctum | `GET /api/v1/sales-tracking/routes/me` |
| GET | `/api/tracking/all-locations` | sanctum (admin,sales) | `GET /api/v1/sales-tracking/locations/current` |
| POST | `/api/sales/orders` | sanctum | `POST /api/v1/sales-orders` |
| GET | `/api/sales/customers` | sanctum | `GET /api/v1/customers/search` |
| GET | `/api/sales/products` | sanctum | `GET /api/v1/products/search` |
| GET | `/api/master/products` | sanctum | `GET /api/v1/products/search` |
| GET | `/api/master/customers` | sanctum | `GET /api/v1/customers/search` |

## C. Web routes → API candidates (per domain)

### Master Data (`master-data`, role: admin,sales)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/master-data/products` | `GET /api/v1/products` |
| GET | `/master-data/products/search` | `GET /api/v1/products/search` |
| POST | `/master-data/products` | `POST /api/v1/products` |
| GET/PUT/DELETE | `/master-data/products/{id}` | `GET/PUT/DELETE /api/v1/products/{id}` |
| GET/POST/PUT/DELETE | `/master-data/categories` | `/api/v1/categories` |
| GET/POST/PUT/DELETE | `/master-data/units` | `/api/v1/units` |
| GET/POST/PUT/DELETE | `/master-data/suppliers` | `/api/v1/suppliers` |
| GET/POST/PUT/DELETE | `/master-data/customers` | `/api/v1/customers` |
| — | (warehouses CRUD exists via `WarehouseRequest` but no web routes registered!) | `GET/POST/PUT/DELETE /api/v1/warehouses` |

### Inventory (role: admin; note: web route is `role:admin`, not warehouse)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/inventory/stock` | `GET /api/v1/inventory/stock` |
| GET | `/inventory/stock/history` | `GET /api/v1/inventory/movements` |
| POST | `/inventory/stock-in` | `POST /api/v1/inventory/stock-in` |
| POST | `/inventory/stock-out` | `POST /api/v1/inventory/stock-out` |
| GET/POST/PUT | `/inventory/transfer*` | `/api/v1/inventory/transfers` |
| GET/POST | `/inventory/opname*` | `/api/v1/inventory/opnames` |
| PUT | `/inventory/opname/{id}/approve` | `POST /api/v1/inventory/opnames/{id}/finalize` |
| GET | `/inventory/opname/{id}/export` | `GET /api/v1/inventory/opnames/{id}/export` |

### Purchasing (role: admin,finance)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/purchasing/po` | `GET /api/v1/purchase-orders` |
| POST | `/purchasing/po` | `POST /api/v1/purchase-orders` |
| GET/PUT/DELETE | `/purchasing/po/{id}` | `GET/PUT/DELETE /api/v1/purchase-orders/{id}` |
| PUT | `/purchasing/po/{id}/approve` | `POST /api/v1/purchase-orders/{id}/approve` |
| PUT | `/purchasing/po/{id}/cancel` | `POST /api/v1/purchase-orders/{id}/cancel` |
| GET | `/purchasing/goods-receipt` | `GET /api/v1/goods-receipts` |
| POST | `/purchasing/goods-receipt` | `POST /api/v1/goods-receipts` |
| GET | `/purchasing/supplier-debt` | `GET /api/v1/purchase-orders/debts` |
| PUT | `/purchasing/supplier-debt/{id}/pay` | `POST /api/v1/purchase-orders/{id}/pay` |
| GET/POST | `/purchasing/voucher*` | `/api/v1/vouchers` |

### Sales (role: admin,sales)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/sales/order` | `GET /api/v1/sales-orders` |
| POST | `/sales/order` | `POST /api/v1/sales-orders` |
| GET/PUT/DELETE | `/sales/order/{id}` | `GET/PUT/DELETE /api/v1/sales-orders/{id}` |
| POST | `/sales/order/{id}/confirm` | `POST /api/v1/sales-orders/{id}/confirm` |
| PUT | `/sales/order/{id}/cancel` | `POST /api/v1/sales-orders/{id}/cancel` |
| POST | `/sales/pos` | `POST /api/v1/pos` |
| GET | `/sales/receivables` | `GET /api/v1/invoices/receivables` |

### Fakturisasi (role: admin,sales,finance)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/fakturisasi/invoice` | `GET /api/v1/invoices` |
| POST | `/fakturisasi/invoice` | `POST /api/v1/invoices` |
| GET/PUT/DELETE | `/fakturisasi/invoice/{id}` | `GET/PUT/DELETE /api/v1/invoices/{id}` |
| PUT | `/fakturisasi/invoice/{id}/send` | `POST /api/v1/invoices/{id}/send` |
| GET | `/fakturisasi/invoice/{id}/print` | `GET /api/v1/invoices/{id}/print` |
| GET | `/fakturisasi/payment` | `GET /api/v1/payments` |
| POST | `/fakturisasi/payment` | `POST /api/v1/payments` |
| GET | `/fakturisasi/report` | `GET /api/v1/invoices/report` |

### Finance (role: admin,finance)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/finance/cashflow` | `GET /api/v1/cashflows` |
| POST | `/finance/cashflow` | `POST /api/v1/cashflows` |
| GET/PUT/DELETE | `/finance/cashflow/{id}` | `GET/PUT/DELETE /api/v1/cashflows/{id}` |
| GET | `/finance/reports` | `GET /api/v1/reports/cashflow` |

### HR (roles vary per route)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/hr/employees` | `GET /api/v1/employees` |
| POST | `/hr/employees` | `POST /api/v1/employees` |
| GET/PUT/DELETE | `/hr/employees/{id}` | `GET/PUT/DELETE /api/v1/employees/{id}` |
| GET | `/hr/attendance` | `GET /api/v1/hr/attendance` |
| POST | `/hr/attendance` | `POST /api/v1/hr/attendance` |
| GET | `/hr/attendance/me` | `GET /api/v1/hr/attendance/me` |
| GET/POST | `/hr/leave` | `/api/v1/hr/leaves` |
| PUT | `/hr/leave/{id}/approve` | `POST /api/v1/hr/leaves/{id}/approve` |
| PUT | `/hr/leave/{id}/reject` | `POST /api/v1/hr/leaves/{id}/reject` |
| GET | `/hr/payroll` | `GET /api/v1/hr/payrolls` |
| POST | `/hr/payroll/generate` | `POST /api/v1/hr/payrolls/generate` |
| POST | `/hr/payroll/{id}/approve` | `POST /api/v1/hr/payrolls/{id}/approve` |
| GET | `/hr/performance` | `GET /api/v1/hr/performances` |
| POST | `/hr/performance` | `POST /api/v1/hr/performances` |

### Sales Tracking (role: admin,sales)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/sales_tracking/visits` | `GET /api/v1/sales-tracking/visits` |
| POST | `/sales_tracking/visits` | `POST /api/v1/sales-tracking/visits` |
| GET | `/sales_tracking/visits/{id}` | `GET /api/v1/sales-tracking/visits/{id}` |
| GET | `/sales_tracking/locations` | `GET /api/v1/sales-tracking/locations` |
| POST | `/sales_tracking/activities` | `POST /api/v1/sales-tracking/activities` |
| GET/POST | `/sales_tracking/routes` | `/api/v1/sales-tracking/routes` |
| GET | `/sales_tracking/livemap` | `GET /api/v1/sales-tracking/livemap` |

### System (role: admin)
| Method | Path | Go candidate |
|---|---|---|
| GET | `/system/users` | `GET /api/v1/users` |
| POST | `/system/users` | `POST /api/v1/users` |
| GET/PUT/DELETE | `/system/users/{id}` | `GET/PUT/DELETE /api/v1/users/{id}` |
| PUT | `/system/users/{id}/toggle` | `POST /api/v1/users/{id}/toggle` |
| GET/POST/PUT/DELETE | `/system/roles` | `/api/v1/roles` |
| GET | `/system/activity-log` | `GET /api/v1/activity-logs` |
| DELETE | `/system/activity-log/clear` | `DELETE /api/v1/activity-logs` |

### Dashboard
| Method | Path | Go candidate |
|---|---|---|
| GET | `/dashboard/kpis` | `GET /api/v1/dashboard/kpis` |

## D. Notable gaps / notes
- **Warehouses**: `WarehouseRequest` exists but **no web routes**; warehouses managed via seeders only. Go exposes `/api/v1/warehouses` anyway (needed for mobile/POS warehouse selection).
- **Profile** (`/profile`): web only; Go adds `PUT /api/v1/auth/me` for name/email/password.
- **Print invoices / payroll slips**: Blade views today → API returns data; document rendering is a separate concern (PDF) — decided in Phase 3.
- **Exports**: receivables, supplier debt, opname are CSV today — keep CSV in Go, same formatting.