<?php

use App\Http\Middleware\EnsureSanctumOwnerIsCustomer;
use App\Http\Middleware\EnsureSanctumOwnerIsDriver;
use App\Http\Middleware\EnsureUserBelongsToCompany;
use App\Http\Middleware\EnsureUserHasPermission;
use App\Http\Middleware\EnsureUserIsSuperAdmin;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

$app = Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
        // DB-04: versioned so the backend can evolve the API later without
        // breaking already-installed mobile app versions. No mobile app has
        // shipped against the old unprefixed /api/* paths yet, so this is a
        // clean cutover rather than a dual-path deprecation window.
        apiPrefix: 'api/v1',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->alias([
            'super_admin' => EnsureUserIsSuperAdmin::class,
            'company_scoped' => EnsureUserBelongsToCompany::class,
            'permission' => EnsureUserHasPermission::class,
            'sanctum.customer' => EnsureSanctumOwnerIsCustomer::class,
            'sanctum.driver' => EnsureSanctumOwnerIsDriver::class,
        ]);

        // Twilio/Stripe webhooks are signed and independently verified per
        // request, not CSRF-protected — a third-party server can't carry a
        // Laravel session token.
        $middleware->validateCsrfTokens(except: [
            'twilio/*',
            'webhooks/*',
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();

// The app is served from the project root (no /public in the URL), so
// index.php/.htaccess/build/ live at the root too. Laravel's public_path()
// defaults to base_path('public') regardless of where index.php actually
// is — this repoints it so Vite's manifest lookup, public_path('hot'), etc.
// resolve to where the assets actually live.
$app->usePublicPath(dirname(__DIR__));

return $app;
