<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;
use CodeIgniter\Filters\CSRF;
use CodeIgniter\Filters\DebugToolbar;
use CodeIgniter\Filters\Honeypot;
use CodeIgniter\Filters\InvalidChars;
use CodeIgniter\Filters\SecureHeaders;

class Filters extends BaseConfig
{
    /**
     * Configures aliases for Filter classes to
     * make reading things nicer and simpler.
     *
     * @var array<string, class-string|list<class-string>> [filter_name => classname]
     *                                                     or [filter_name => [classname1, classname2, ...]]
     */
    public array $aliases = [
        'csrf'              => CSRF::class,
        'toolbar'           => DebugToolbar::class,
        'honeypot'          => Honeypot::class,
        'invalidchars'      => InvalidChars::class,
        'secureheaders'     => SecureHeaders::class,
        'sanitizeinput'     => \App\Filters\SanitizeInputFilter::class,
        'apiratelimit'      => \App\Filters\ApiRateLimitFilter::class,
        'auth'              => \App\Filters\AuthFilter::class, // Define the alias for your auth filter
        'apiAuth'           => \App\Filters\ApiAuthFilter::class, // JWT-based API authentication
        'cleanupScheduler'  => \App\Filters\CleanupScheduler::class,
        'permission'        => \App\Filters\PermissionFilter::class, 
        'timezone'          => \App\Filters\TimezoneFilter::class,
        'schoolYear'        => \App\Filters\RequireSchoolYearFilter::class,
        'schoolYearWritable'=> \App\Filters\SchoolYearWritableFilter::class,
    ];



    /**
     * List of filter aliases that are always
     * applied before and after every request.
     *
     * @var array<string, array<string, array<string, string>>>|array<string, list<string>>
     */
    public array $globals = [
    'before' => [
        'timezone',
        'sanitizeinput',
        'invalidchars',
        'csrf' => ['except' => [
            // WhatsApp membership management (legacy allowances retained)
            'whatsapp/update-membership',
            'index.php/whatsapp/update-membership',

            // Attendance management AJAX saves
            'attendance/update',
            'index.php/attendance/update',

            // Late slip preview/print from admin attendance page
            'slips/preview',
            'index.php/slips/preview',
            'slips/print',
            'index.php/slips/print',

            // ✅ Parent attendance AJAX conflict check (added)
            'api/parent/report-attendance/check',
            'index.php/api/parent/report-attendance/check',

            // API auth endpoints (no CSRF)
            'api/login',
            'index.php/api/login',
            'api/register',
            'index.php/api/register',
            // API routes (no CSRF, handled by JWT)
            'api/*',
            'index.php/api/*',

            // Badge PDF generation posts (handled by auth; allow multiple submits without reload)
            'badge',
            'index.php/badge',
        ]],
    ],
    'after' => [
        'secureheaders',
        'toolbar',
        'cleanupScheduler' => ['except' => ['cleanup/*']],
    ],
];



    /**
     * List of filter aliases that works on a
     * particular HTTP method (GET, POST, etc.).
     *
     * Example:
     * 'post' => ['foo', 'bar']
     *
     * If you use this, you should disable auto-routing because auto-routing
     * permits any HTTP method to access a controller. Accessing the controller
     * with a method you don't expect could bypass the filter.
     *
     * @var array<string, list<string>>
     */
    public array $methods = [];

    /**
     * List of filter aliases that should run on any
     * before or after URI patterns.
     *
     * Example:
     * 'isLoggedIn' => ['before' => ['account/*', 'profiles/*']]
     *
     * @var array<string, array<string, list<string>>>
     */
    public array $filters = [
        'apiratelimit' => ['before' => ['api/*', 'index.php/api/*']],
    ];

}
