<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;
use CodeIgniter\Filters\CSRF;
use CodeIgniter\Filters\DebugToolbar;
use CodeIgniter\Filters\Honeypot;
use CodeIgniter\Filters\InvalidChars;
use CodeIgniter\Filters\SecureHeaders;

class Filters extends BaseConfig
{
    public array $aliases = [
        'csrf'          => CSRF::class,
        'invalidchars'  => InvalidChars::class,
        'secureheaders' => SecureHeaders::class,
        'honeypot'      => Honeypot::class,
        'cors'          => \App\Filters\Cors::class,
        'toolbar'       => DebugToolbar::class,

        // Custom application filters
        'auth'         => \App\Filters\AuthFilter::class,
        'roleguard'    => \App\Filters\RoleGuard::class,
        'ratelimit'    => \App\Filters\RateLimit::class,
        'tenant'       => \App\Filters\TenantScope::class,
        'installguard' => \App\Filters\InstallGuard::class,
    ];

    /**
     * Filters run on every request regardless of route.
     */
    public array $globals = [
        'before' => [
            'invalidchars',
            'secureheaders',
            // 'csrf' applied selectively below (API is stateless bearer-auth,
            // web forms need CSRF — see 09-security-plan.md §3)
        ],
        'after' => [
            'secureheaders',
        ],
    ];

    public array $methods = [];

    /**
     * Filters applied to route groups by URI pattern — belt-and-braces
     * alongside the per-route filters already declared in Routes.php.
     */
    public array $filters = [
        'csrf' => ['before' => ['login', 'register', 'admin/*']],
        'cors' => ['before' => ['api/*']],
    ];
}
