<?php

use App\Http\Middleware\BasicAuthMiddleware;
use App\Http\Middleware\LogApiUsage;
use App\Http\Middleware\RejectLegacyApiKeys;
use App\Http\Middleware\SecurityHeaders;
use App\Http\Middleware\SetCurrentPortal;
use App\Http\Middleware\SetEdition;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Laravel\Sanctum\Http\Middleware\CheckAbilities;
use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/domains.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
        then: function (): void {
            // Legacy-API-Aliasse (/service/… ohne /api-Präfix) in der
            // api-Middleware-Gruppe — Übernahme bestehender Integrationen.
            Route::middleware('api')->group(__DIR__.'/../routes/legacy-api.php');
        },
    )
    ->withMiddleware(function (Middleware $middleware) {

        // Security-Header auf allen Antworten (Web + API), Proxy-unabhängig.
        $middleware->append(SecurityHeaders::class);

        // Portal-Kontext nach dem Theme-Provider setzen (liest config('app.theme'))
        $middleware->append(SetCurrentPortal::class);

        // Ausgabe/Sprache (de|en) aus dem URL-Präfix ableiten und URL-Defaults setzen.
        $middleware->append(SetEdition::class);

        // Wohin eingeloggte User von Gast-Routen (/login, /register) gelenkt
        // werden: rollen- und verifizierungsbewusst statt fix auf /dashboard,
        // sonst landet ein Customer dort im 403 und sitzt fest.
        $middleware->redirectUsersTo(function (Request $request) {
            $user = $request->user();

            if ($user && ! $user->hasVerifiedEmail()) {
                return route('verification.notice');
            }

            if ($user?->canAccessAdmin()) {
                return route('dashboard');
            }

            return $user?->canAccessCustomer() ? route('me.dashboard') : '/';
        });

        $middleware->api(prepend: [
            LogApiUsage::class,
            RejectLegacyApiKeys::class,
        ]);

        $middleware->alias([
            'abilities' => CheckAbilities::class,
            'ability' => CheckForAnyAbility::class,
        ]);

        // BasicAuth ganz am Ende, nach Session-Middleware. Immer anhängen;
        // ob erzwungen wird, entscheidet die Middleware zur Laufzeit anhand
        // von config('auth.basic.*') (greift auch unter `config:cache`).
        $middleware->append(BasicAuthMiddleware::class);
        // Trust all proxies (for Traefik/Docker setup)
        $middleware->trustProxies(
            at: '*',
            headers: Request::HEADER_X_FORWARDED_FOR |
                Request::HEADER_X_FORWARDED_HOST |
                Request::HEADER_X_FORWARDED_PORT |
                Request::HEADER_X_FORWARDED_PROTO
        );
    })
    ->withExceptions(function (Exceptions $exceptions) {
        //
    })->create();