<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->alias([
            'tenant' => \App\Http\Middleware\TenantMiddleware::class,
            'tenant.user' => \App\Http\Middleware\EnsureTenantUser::class,
            'tenant.permission' => \App\Http\Middleware\CheckTenantPermission::class,
            'tenant.module' => \App\Http\Middleware\CheckSubscriptionModule::class,
            'superadmin' => \App\Http\Middleware\EnsureSuperAdmin::class,
            'subscription' => \Modules\SaaS\Http\Middleware\CheckSubscriptionActive::class,
            'tenant.subscription' => \App\Http\Middleware\EnsureCompanySubscriptionAccess::class,
            'tenant.2fa' => \App\Http\Middleware\EnsureCompanyTwoFactorEnrolled::class,
            'tenant.session' => \App\Http\Middleware\TouchUserSession::class,
            'account.active' => \App\Http\Middleware\EnsureAccountActive::class,
            'finance.treasury' => \App\Http\Middleware\EnsureFinanceTreasuryAccess::class,
            'finance.operational' => \App\Http\Middleware\EnsureFinanceOperationalAccess::class,
            'biometric.device' => \App\Http\Middleware\AuthenticateBiometricDevice::class,
        ]);
        $middleware->statefulApi();
        $middleware->append(\App\Http\Middleware\SecurityHeaders::class);
    })
    ->withExceptions(function (Exceptions $exceptions) {
        $exceptions->render(function (\Illuminate\Auth\Access\AuthorizationException $e, \Illuminate\Http\Request $request) {
            $user = $request->user();
            $nav = app(\App\Services\Finance\FinanceNavService::class);

            if (
                $user
                && ! $request->expectsJson()
                && $nav->canAccessModule($user)
                && $nav->isMappedFinanceRoute((string) $request->route()?->getName())
            ) {
                return redirect()
                    ->to($nav->homeUrl($user))
                    ->with('error', $e->getMessage() ?: 'You do not have permission for that finance action.');
            }

            return null;
        });
    })->create();