<?php

declare(strict_types=1);

use App\Http\Middleware\AllowPreview;
use App\Http\Middleware\CachePublicResponse;
use App\Http\Middleware\EnsureSiteIsAvailable;
use App\Http\Middleware\SetLocale;
use App\Http\Middleware\VerifyIngestToken;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Spatie\Permission\Middleware\PermissionMiddleware;
use Spatie\Permission\Middleware\RoleMiddleware;
use Spatie\Permission\Middleware\RoleOrPermissionMiddleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
        apiPrefix: 'api',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        // Locale negotiation runs on both stacks: the panel needs it for the
        // UI, the API for Accept-Language and translated payloads.
        $middleware->web(append: [SetLocale::class]);
        $middleware->api(append: [SetLocale::class]);

        $middleware->alias([
            'role' => RoleMiddleware::class,
            'permission' => PermissionMiddleware::class,
            'role_or_permission' => RoleOrPermissionMiddleware::class,

            // Public API: HTTP caching for an SSR frontend, and the secret
            // that lets it render unpublished content.
            'cache.public' => CachePublicResponse::class,
            'preview' => AllowPreview::class,

            // The one public endpoint the frontend writes to on its own
            // behalf, rather than on behalf of a visitor filling in a form.
            'ingest' => VerifyIngestToken::class,

            // Maintenance for the public site only — never for the panel.
            'site.available' => EnsureSiteIsAvailable::class,
        ]);

        // Guests hitting a panel route get the "sign in with Pireon" page
        // rather than Laravel's default /login form.
        $middleware->redirectGuestsTo(fn (Request $request) => route('login'));
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        $exceptions->shouldRenderJsonWhen(
            fn (Request $request) => $request->is('api/*') || $request->expectsJson(),
        );
    })->create();