<?php

namespace Modules\Licensing\Providers;

use Illuminate\Support\ServiceProvider;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Gate;
use App\Models\User;

/** Explicitly mounted licensing API. Portal integration remains gated pending auth review. */
final class IntegratedLicensingServiceProvider extends ServiceProvider
{
    public function boot(): void
    {
        RateLimiter::for('license-activation', static fn (Request $request): array => [
            Limit::perMinute(12)->by($request->ip()),
            Limit::perMinute(6)->by(hash('sha256', (string) $request->input('installationID'))),
        ]);

        $this->mergeConfigFrom(base_path('config/sonardesk-paddle.php'), 'sonardesk-paddle');
        $this->mergeConfigFrom(base_path('config/sonardesk-integration.php'), 'sonardesk-integration');
        $this->loadMigrationsFrom(__DIR__.'/../Database/Migrations');
        $this->loadViewsFrom(__DIR__.'/../Resources/views', 'licensing');
        $this->mergeConfigFrom(__DIR__.'/../Config/config.php', 'licensing');

        // Explicit role-based authorization; deny access by default.
        Gate::define('manage-sonardesk-licensing', static fn (User $user): bool =>
            ($user->hasPermissionTo('manage-sonardesk-licensing', 'web') || $user->hasAnyRole(['Super Admin', 'super-admin', 'Administrator']))
        );

        Route::prefix('api')->middleware('api')->group(__DIR__.'/../Routes/api.php');
        Route::group([], __DIR__.'/../Routes/admin.php');
        Route::group([], __DIR__.'/../Routes/customer.php');
        Route::group([], __DIR__.'/../Routes/distribution.php');
        Route::group([], __DIR__.'/../Routes/checkout.php');
    }
}