ldc-legaulois/app/Providers/RouteServiceProvider.php

<?php

namespace App\Providers;

use App\Enums\StaticPageType;
use App\Http\Middleware\VerifyCsrfToken;
use App\Models\Approach;
use App\Models\BrandAdvantage;
use App\Models\Claim;
use App\Models\ConsumptionMoment;
use App\Models\DemarcheSlide;
use App\Models\HistoricalMilestone;
use App\Models\KeyNumber;
use App\Models\MainSlide;
use App\Models\Meat;
use App\Models\News;
use App\Models\NewsBreeding;
use App\Models\NewsCategory;
use App\Models\NewsClub;
use App\Models\NewsCorporate;
use App\Models\Offer;
use App\Models\Product;
use App\Models\ProductType;
use App\Models\Profession;
use App\Models\Range;
use App\Models\Recipe;
use App\Models\StaticPage;
use App\Models\Submeat;
use App\Models\Subrange;
use App\Models\SurveysAnswer;
use App\Models\Testimonial;
use App\Models\User;
use App\Models\Video;
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Facades\Route;

class RouteServiceProvider extends ServiceProvider
{
    /**
     * The path to your application's "home" route.
     *
     * Typically, users are redirected here after authentication.
     *
     * @var string
     */
    public const HOME = '/';

    /**
     * Define your route model bindings, pattern filters, and other route configuration.
     */
    public function boot(): void
    {
        $this->configureRateLimiting();

        $this->cspReportRoute();

        $this->routes(function () {
            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web-bo.php'));

            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web-fo.php'));

            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web-club.php'));
        });

        Route::model('user', User::class);
        Route::model('profession', Profession::class);
        Route::model('brand_advantage', BrandAdvantage::class);
        Route::model('key_number', KeyNumber::class);
        Route::model('main_slide', MainSlide::class);
        Route::model('demarche_slide', DemarcheSlide::class);
        Route::model('range', Range::class);
        Route::model('subrange', Subrange::class);
        Route::model('meat', Meat::class);
        Route::model('submeat', Submeat::class);
        Route::model('approach', Approach::class);
        Route::model('consumption_moment', ConsumptionMoment::class);
        Route::model('video', Video::class);
        Route::model('recipe', Recipe::class);
        Route::model('claim', Claim::class);
        Route::model('product', Product::class);
        Route::model('product_type', ProductType::class);
        Route::model('offer', Offer::class);
        Route::model('news_corporate', NewsCorporate::class);
        Route::model('testimonial', Testimonial::class);
        Route::model('news_breeding', NewsBreeding::class);
        Route::model('historical_milestone', HistoricalMilestone::class);
        Route::model('news', News::class);
        Route::model('news_category', NewsCategory::class);
        Route::model('news_club', NewsClub::class);
        Route::model('surveys_answer', SurveysAnswer::class);

        Route::bind('breeding_static_page', function ($value) {
            return StaticPage::query()
                ->whereIn('type', StaticPageType::getBreedingPages())
                ->where(function ($q) use ($value) {
                    $q->where('slug', $value);
                })->firstOrFail();
        });
        Route::bind('published_news_breeding', function ($value) {
            return NewsBreeding::query()
                ->where('published', true)
                ->where(function ($q) use ($value) {
                    $q->where('slug', $value);
                })->firstOrFail();
        });
    }

    /**
     * Configure the rate limiters for the application.
     */
    protected function configureRateLimiting(): void
    {
        RateLimiter::for('api', function (Request $request) {
            return Limit::perMinute(150)->by($request->user()?->getKey() ?: app('clientIp'));
        });
        RateLimiter::for('web', function (Request $request) {
            return Limit::perMinute(150)->by($request->user()?->getKey() ?: app('clientIp'));
        });
        RateLimiter::for('club', function (Request $request) {
            return Limit::perMinute(150)->by($request->user()?->getKey() ?: app('clientIp'));
        });
        RateLimiter::for('credentials', function (Request $request) {
            return Limit::perMinute(30)->by($request->user()?->getKey() ?: app('clientIp'));
        });
    }

    /**
     * * Register CSP report URI
     *
     * Put this function inside RouteServiceProvider,
     * and call it in RouteServiceProvider::boot
     */
    private function cspReportRoute(): void
    {
        // * CSP REPORT URI, Please add /csp-report to VerifyCsrfToken $except middleware
        Route::post('/csp-report', function () {
            $isCspRequest = request()->header('Content-Type') === 'application/csp-report';
            if (! $isCspRequest or ! request()->json('csp-report') or ! is_array(request()->json('csp-report'))) {
                abort(401);
            }
            // * Flatten if needed
            $cspReport = collect(request()->json('csp-report'))
                ->flatMap(function ($v, $k) {
                    return [$k => is_array($v) ? collect($v)->flatten()->implode(', ') : $v];
                })->all();
            // * Filter array keys
            $cspReport = collect(array_intersect_key($cspReport, [
                'blocked-uri'        => '',
                'document-uri'       => '',
                'original-policy'    => '',
                'referrer'           => '',
                'violated-directive' => '',
            ]));
            Log::warning(sprintf(
                "CSP REPORT for %s : \n %s",
                $cspReport->get('document-uri'),
                $cspReport->implode("\n")
            ));
        })->middleware('throttle:5,2')
            ->withoutMiddleware(VerifyCsrfToken::class)
            ->name('cspReportUri');
    }
}