<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Route;
use Illuminate\Validation\ValidationException;
use Symfony\Component\HttpKernel\Exception\HttpException;
use Uwil\LaravelCommon\Helpers\InertiaHelper;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        health: '/up',
        web: __DIR__ . '/../routes/auth.php',
        then: function () {
            Route::middleware(['web', 'throttle:5,2'])
                ->post('/csp-report', function () {
                    $isCspRequest = request()->header('Content-Type') === 'application/csp-report';
                    if (!$isCspRequest or !request()->json('csp-report') or !is_array(request()->json('csp-report'))) {
                        abort(401);
                    }
                    // * Flatten if needed.
                    $cspReport = collect(request()->json('csp-report'))
                        ->flatMap(function ($v, $k) {
                            return [$k => is_array($v) ? collect($v)->flatten()->implode(', ') : $v];
                        })->all();
                        // * Filter array keys.
                    $cspReport = collect(array_intersect_key($cspReport, [
                        'blocked-uri'        => '',
                        'document-uri'       => '',
                        'original-policy'    => '',
                        'referrer'           => '',
                        'violated-directive' => '',
                    ]));
                    Log::warning(sprintf(
                        "CSP REPORT for %s : \n %s",
                        $cspReport->get('document-uri'),
                        $cspReport->implode("\n")
                    ));
                })->name('cspReportUri');
        }
    )
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->web(append: [
            \Uwil\LaravelI18n\Middlewares\ForceLocale::class,
            \App\Http\Middlewares\HandleInertiaRequests::class,
            \Illuminate\Http\Middleware\AddLinkHeadersForPreloadedAssets::class,
            \Uwil\LaravelCommon\Middlewares\SecureHeaders::class,
            \Uwil\LaravelCommon\Middlewares\TrimStrings::class,
            \Uwil\LaravelCommon\Middlewares\TrustHosts::class,
            \Uwil\LaravelCommon\Middlewares\TrustProxies::class,
            \Uwil\LaravelBackend\Middlewares\LogoutUnpublishedUsers::class,
        ]);
        $middleware->preventRequestForgery(except: [
            '/csp-report',
        ]);
        $middleware->alias([
            'auth'  => \Uwil\LaravelBackend\Middlewares\Authenticate::class,
            'guest' => \Uwil\LaravelBackend\Middlewares\RedirectIfAuthenticated::class,
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions) {
        $exceptions->render(function (HttpException $e, Request $request) {
            $status = $e->getStatusCode();
            return InertiaHelper::errorRender($request, $status);
        });
        /**
         * Automatic exception capture with Sentry.
         */
        $exceptions->report(function (Throwable $e) {
            if (app()->bound('sentry')) {
                app('sentry')->captureException($e);
            }
        });
        /**
         * Handling validation errors by excluding sensitive fields from the flash.
         */
        $exceptions->render(function (ValidationException $e, Request $request) {
            $safeInput = collect($request->all())
                ->except(['password', 'password_confirmation', 'current_password'])
                ->toArray();
            return back()
                ->withInput($safeInput)
                ->withErrors($e->errors());
        });
    })
    ->withCommands([
        \App\Console\Commands\MakeUser::class,
    ])
    ->create();