3dealer/bootstrap/app.php

<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        // Laravel's priority list would otherwise run `auth` before core's
        // `locale` middleware, so the redirects below would build URLs before
        // URL::defaults(['locale' => …]) is set, throwing a missing-parameter error.
        $middleware->prependToPriorityList(
            before: \Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests::class,
            prepend: \Modules\Core\Localization\Middleware\LocaleMiddleware::class,
        );

        // Both resolve inside the {locale} group, after the `locale` middleware
        // has set URL::defaults(['locale' => …]), so route() needs no locale arg.
        $middleware->redirectGuestsTo(fn () => route('login'));
        $middleware->redirectUsersTo(fn () => route('home'));

        // In production, the host's reverse proxy talks to the nginx container
        // (bound to 127.0.0.1 only), so without this every visitor has the
        // proxy's IP: the per-IP `throttle` limits on login become one shared
        // bucket for the whole site. '*' trusts only the direct hop.
        $middleware->trustProxies(at: '*');

        // Enforces core's session registry: a session revoked via
        // UserSessionService is logged out on its next request. Core leaves
        // registering this to the app.
        $middleware->web(append: [
            \Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked::class,
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();