<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Facades\Route;

class RouteServiceProvider extends ServiceProvider
{
    /**
     * The path to the "home" route for your application.
     *
     * This is used by Laravel authentication to redirect users after login.
     *
     * @var string
     */
    public const HOME = '/home';

    /**
     * The controller namespace for the application.
     *
     * When present, controller route declarations will automatically be prefixed with this namespace.
     *
     * @var string|null
     */
    // protected $namespace = 'App\\Http\\Controllers';

    /**
     * Define your route model bindings, pattern filters, etc.
     *
     * @return void
     */
    public function boot()
    {
        $this->configureRateLimiting();

        $this->routes(function () {
            Route::prefix('api')
                ->middleware(['api'])
                ->namespace($this->namespace)
                ->group(base_path('routes/admin-media.php'));

            Route::prefix('api')
                ->middleware(['api', 'json.response'])
                ->namespace($this->namespace)
                ->group(base_path('routes/api.php'));

            Route::middleware(['api', 'json.response'])
                ->namespace($this->namespace)
                ->group(base_path('routes/client.php'));

            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web.php'));
        });
    }

    /**
     * Configure the rate limiters for the application.
     *
     * @return void
     */
    protected function configureRateLimiting()
    {
        RateLimiter::for('api', function (Request $request) {
            // Admin SPA makes many parallel requests per page — use a higher limit for authenticated users
            // Guard mặc định là admin → khách (JWT guard client) phải lấy riêng, nếu không mọi khách bị đếm theo IP.
            $key = ($admin = $request->user()) ? 'admin:' . $admin->id
                : (($client = $request->user('client')) ? 'client:' . $client->id : null);

            return Limit::perMinute($key ? 300 : 60)->by($key ?: $request->ip());
        });

        RateLimiter::for('invoice-lookup', fn (Request $request) => [
            Limit::perMinute(10)->by('invoice-lookup|' . strtoupper((string) $request->input('invoice_number'))),
            Limit::perMinute(30)->by('invoice-lookup|ip|' . $request->ip()),
        ]);

        // Auth endpoint của khách (login/verify/forgot...). portal-client gọi API từ Next server nên
        // IP gần như luôn là IP của Next → khoá theo route + email, không theo IP (tránh chặn chung mọi khách).
        RateLimiter::for('client-auth', function (Request $request) {
            $email = strtolower(trim((string) $request->input('email')));
            $route = $request->route()?->getName();
            $byEmail = Limit::perMinute(5)->by($route . '|' . ($email ?: $request->ip()));

            $perIpHourly = [
                'api.client.register'      => 5,
                'api.client.resend-verify' => 10,
            ];

            if (!isset($perIpHourly[$route])) {
                return $byEmail;
            }

            return [$byEmail, Limit::perHour($perIpHourly[$route])->by($route . '|ip|' . $request->ip())];
        });
    }
}