<?php

use App\Http\Middleware\CheckTokenExpiration;
use App\Http\Middleware\DetectDomain;
use App\Http\Middleware\EnsureClientAccess;
use App\Http\Middleware\EnsureTwoFactorChallenged;
use App\Http\Middleware\EnsureUserIsAdmin;
use App\Http\Middleware\QueryProfiler;
use App\Http\Middleware\SecurityHeaders;
use App\Http\Middleware\SessionSecurity;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\ModelNotFoundException;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        channels: __DIR__.'/../routes/channels.php',
        health: '/up',
        then: function () {
            // Domain-based routing for multi-site setup
            // These routes take precedence when accessing via specific domains

            // Marketing site (scopeforged.com)
            Route::domain(config('domains.marketing'))
                ->middleware('web')
                ->group(base_path('routes/marketing.php'));

            // Portal subdomain (portal.scopeforged.com)
            Route::domain(config('domains.portal'))
                ->middleware('web')
                ->group(base_path('routes/portal-domain.php'));

            // Admin subdomain (admin.scopeforged.com)
            Route::domain(config('domains.admin'))
                ->middleware(['web', 'auth', 'verified', 'admin'])
                ->group(base_path('routes/admin-domain.php'));
        },
    )
    ->withMiddleware(function (Middleware $middleware): void {
        // Redirect unauthenticated users to marketing login
        $middleware->redirectGuestsTo(fn () => marketing_url('/login'));

        // Global web middleware
        $middleware->web(append: [
            DetectDomain::class,
            SecurityHeaders::class,
            SessionSecurity::class,
        ]);

        // API middleware
        $middleware->api(append: [
            CheckTokenExpiration::class,
        ]);

        // Middleware aliases
        $middleware->alias([
            'admin' => EnsureUserIsAdmin::class,
            'client.access' => EnsureClientAccess::class,
            'two-factor.challenged' => EnsureTwoFactorChallenged::class,
            'api.version' => \App\Http\Middleware\ApiVersion::class,
            'api.log' => \App\Http\Middleware\LogApiUsage::class,
            'auth.api_key' => \App\Http\Middleware\AuthenticateApiKey::class,
            'query.profiler' => QueryProfiler::class,
        ]);

        // Allow admin routes to bypass maintenance mode
        $middleware->preventRequestsDuringMaintenance(except: [
            'admin/*',
            'login',
            'logout',
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        $exceptions->render(function (AuthorizationException $e, Request $request) {
            if ($request->expectsJson()) {
                return response()->json(['message' => 'Forbidden'], 403);
            }
        });

        $exceptions->render(function (ModelNotFoundException $e, Request $request) {
            if ($request->expectsJson()) {
                return response()->json(['message' => 'Resource not found'], 404);
            }
        });

        $exceptions->render(function (NotFoundHttpException $e, Request $request) {
            if ($request->expectsJson()) {
                return response()->json(['message' => 'Not found'], 404);
            }
        });
    })->create();