<?php

use App\Http\Middleware\Authenticate;
use App\Http\Middleware\CheckIfBanned;
use App\Http\Middleware\CheckPermissions;
use App\Http\Middleware\CheckRole;
use App\Http\Middleware\DatabaseSession;
use App\Http\Middleware\DemoMode;
use App\Http\Middleware\EnsureUserIsApproved;
use App\Http\Middleware\ForcePasswordChange;
use App\Http\Middleware\HandleInertiaRequests;
use App\Http\Middleware\PasswordResetEnabled;
use App\Http\Middleware\RegistrationEnabled;
use App\Http\Middleware\SetLocale;
use App\Http\Middleware\SocialLogin;
use App\Http\Middleware\TwoFactorEnabled;
use App\Http\Middleware\UseApiGuard;
use App\Http\Middleware\VerifyInstallation;
use App\Http\Middleware\VerifyTwoFactorCode;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Routing\Middleware\SubstituteBindings;
use Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        using: function () {
            if (config('auth.expose_api')) {
                Route::middleware('api')
                    ->prefix('api')
                    ->name('api.')
                    ->group(base_path('routes/api.php'));
            }

            Route::middleware([
                VerifyInstallation::class,
                'web',
            ])->group(base_path('routes/web.php'));
        },
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->alias([
            'auth' => Authenticate::class,
            'bindings' => SubstituteBindings::class,
            'registration' => RegistrationEnabled::class,
            'social.login' => SocialLogin::class,
            'role' => CheckRole::class,
            'permission' => CheckPermissions::class,
            'session.database' => DatabaseSession::class,
            'two-factor' => TwoFactorEnabled::class,
            'verify-2fa-code' => VerifyTwoFactorCode::class,
            'password-reset' => PasswordResetEnabled::class,
            'banned' => CheckIfBanned::class,
            'approved' => EnsureUserIsApproved::class,
            'password-change' => ForcePasswordChange::class,
        ]);

        // DemoMode is last so that a refusal is the final word on a request
        // that got this far. It has to stay after SubstituteBindings, which
        // the group already runs first, because its rules read the route bound
        // user, role and permission models.
        $middleware->web([
            SetLocale::class,
            'banned',
            HandleInertiaRequests::class,
            DemoMode::class,
        ]);

        $middleware->api([
            UseApiGuard::class,
            EnsureFrontendRequestsAreStateful::class,
            'throttle:60,1',
            'banned',
            DemoMode::class,
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();