udpate

app/Http/Kernel.php

@@ -68,6 +68,8 @@ class Kernel extends HttpKernel
         'ability' => \Laravel\Sanctum\Http\Middleware\CheckForAnyAbility::class,
         'CustomerLoginCheck' => \App\Http\Middleware\CustomerLoginCheck::class,
         'IsLoginCheck' => \App\Http\Middleware\IsLoginCheck::class,
-        'Staff' => \App\Http\Middleware\StaffCheck::class
+        'Staff' => \App\Http\Middleware\StaffCheck::class,
+        'json.response' => \App\Http\Middleware\ForceJsonResponse::class,
+        'api.auth' => \App\Http\Middleware\ApiAuthCheck::class,
     ];
 }

app/Http/Middleware/ApiAuthCheck.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class ApiAuthCheck
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next, $guard = null)
+    {
+        $checkGuard = $guard ?: 'sanctum';
+
+        if (!Auth::guard($checkGuard)->check()) {
+            return response()->json([
+                'error' => true,
+                'message' => 'Unauthorized. Access Denied.',
+                'data' => [],
+                'code' => 401
+            ], 401);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/ForceJsonResponse.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ForceJsonResponse
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $request->headers->set('Accept', 'application/json');
+
+        return $next($request);
+    }
+}

app/Providers/RouteServiceProvider.php

@@ -38,11 +38,19 @@ class RouteServiceProvider extends ServiceProvider
         $this->configureRateLimiting();
 
         $this->routes(function () {
-            Route::domain('api-agency.tgs.com.vn')
-                ->middleware('api')
+            // 1. Agency API (Domain riêng, dùng routes/client.php)
+            Route::domain('api-agency.tgs.com.vn.test')
+                ->middleware(['api', 'json.response'])
+                ->namespace($this->namespace)
+                ->group(base_path('routes/client.php'));
+
+            // 2. System API (Dùng cho portal.test/api/..., dùng routes/api.php)
+            Route::prefix('api')
+                ->middleware(['api', 'json.response'])
                 ->namespace($this->namespace)
                 ->group(base_path('routes/api.php'));
 
+            // 3. Web & Admin routes
             Route::middleware('web')
                 ->namespace($this->namespace)
                 ->group(base_path('routes/web.php'));