<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->useEnvironmentPath('/home/intaleq-api/env')
    ->withRouting(
        api: __DIR__.'/../routes/api.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        // Register custom middleware aliases
        $middleware->alias([
            'hmac.auth' => \App\Http\Middleware\HmacAuthMiddleware::class,
            'jwt.auth' => \App\Http\Middleware\JwtAuthMiddleware::class,
            'admin' => \App\Http\Middleware\AdminMiddleware::class,
        ]);

        // Global API middleware
        $middleware->api(prepend: [
            \Illuminate\Http\Middleware\HandleCors::class,
        ]);

        // Rate limiting for API
        $middleware->throttleWithRedis();
    })
    ->withExceptions(function (Exceptions $exceptions) {
        // Never expose internal errors to API consumers
        $exceptions->render(function (\Throwable $e) {
            if (request()->expectsJson() || request()->is('v2/*')) {
                $status = method_exists($e, 'getStatusCode') ? $e->getStatusCode() : 500;
                
                $response = [
                    'status' => 'failure',
                    'message' => $status === 500 ? 'Internal server error' : $e->getMessage(),
                ];

                // Only include debug info in non-production
                if (config('app.debug') && $status === 500) {
                    $response['debug'] = [
                        'exception' => get_class($e),
                        'message' => $e->getMessage(),
                        'file' => $e->getFile() . ':' . $e->getLine(),
                    ];
                }

                return response()->json($response, $status);
            }
        });
    })
    ->create();