<?php

namespace App\Http\Middleware;

/**
 * Extends Sanctum's stateful frontend handling so session cookie SameSite/Secure
 * respect SESSION_SAME_SITE and SESSION_SECURE_COOKIE when set (e.g. for
 * cross-subdomain SPA at azaanhospital.com calling API at backend.azaanhospital.com).
 */
class EnsureFrontendRequestsAreStateful extends \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful
{
    /**
     * Configure secure cookie sessions. Use env when set so cross-subdomain
     * cookies (SameSite=None; Secure) work; otherwise fall back to Sanctum default.
     *
     * @return void
     */
    protected function configureSecureCookieSessions(): void
    {
        $sameSite = env('SESSION_SAME_SITE');
        $secure = env('SESSION_SECURE_COOKIE');

        config([
            'session.http_only' => true,
            'session.same_site' => $sameSite !== null && $sameSite !== '' ? $sameSite : 'lax',
            'session.secure' => filter_var($secure, FILTER_VALIDATE_BOOLEAN),
        ]);
    }
}
