staff update

routes/web.php

@@ -10,6 +10,7 @@ use App\Http\Controllers\Admin\AdminInvoiceController;
 use App\Http\Controllers\Admin\AdminCustomerController;
 use App\Http\Controllers\Admin\AdminAccountController;
 use App\Http\Controllers\Admin\AdminReportController;
+use App\Http\Controllers\Admin\AdminStaffController;
 
 // ---------------------------
 // Public Front Page
@@ -21,19 +22,11 @@ Route::get('/', function () {
 // ---------------------------
 // ADMIN LOGIN ROUTES
 // ---------------------------
+// login routes (public)
 Route::prefix('admin')->group(function () {
-
-    // MUST have route name "login" for session redirect
-    Route::get('/login', [AdminAuthController::class, 'showLoginForm'])
-        ->name('admin.login');
-
-    Route::post('/login', [AdminAuthController::class, 'login'])
-        ->name('admin.login.submit');
-
-    Route::post('/logout', [AdminAuthController::class, 'logout'])
-        ->name('admin.logout');
-
-    
+    Route::get('/login', [AdminAuthController::class, 'showLoginForm'])->name('admin.login');
+    Route::post('/login', [AdminAuthController::class, 'login'])->name('admin.login.submit');
+    Route::post('/logout', [AdminAuthController::class, 'logout'])->name('admin.logout');
 });
 
 
@@ -295,4 +288,13 @@ Route::prefix('admin')
         //---------------------------
           //Edit Button Route
         //---------------------------
+       // protected admin routes
+    Route::middleware(['auth:admin'])
+        ->prefix('admin')
+        ->name('admin.')
+        ->group(function () {
         
+
+            // staff resource
+            Route::resource('staff', AdminStaffController::class);
+    });