auth tests

backend/bootstrap/app.php

@@ -1,18 +1,46 @@
 <?php
 
+use App\Http\Middleware\EnsureSetupComplete;
+use App\Http\Middleware\ForceJsonResponse;
+use App\Http\Middleware\IsAdmin;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Route;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
+        api: __DIR__.'/../routes/api.php', // NOSONAR
         web: __DIR__.'/../routes/web.php',
         commands: __DIR__.'/../routes/console.php',
         health: '/up',
+        then: function (): void {
+            // Auto-discovery: ogni file in routes/api/ è caricato come gruppo sotto
+            // prefisso `api` e stack `api`. Aggiungere un modello = creare un file lì,
+            // senza toccare questo bootstrap. glob() ordina alfabeticamente → ordine
+            // di registrazione deterministico. (Dopo aver aggiunto un file, se usi la
+            // route cache rilancia `route:cache`, come per qualunque nuova rotta.)
+            foreach (glob(base_path('routes/api/*.php')) as $routeFile) {
+                Route::middleware('api')->prefix('api')->group($routeFile);
+            }
+        },
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        // per Sanctum
+        $middleware->statefulApi();
+        // Configurazione CORS
+        $middleware->preventRequestForgery(except: ['api/*']);
+        $middleware->alias([
+            'admin' => IsAdmin::class,
+            'setup.complete' => EnsureSetupComplete::class,
+        ]);
+        // Tier riusabili nei file di routes/api/ — fonte di verità unica.
+        // (nomi `tier.*` per non confliggere con l'alias `admin`.)
+        $middleware->group('tier.app', ['auth:sanctum', 'verified', 'setup.complete']);
+        $middleware->group('tier.admin', ['auth:sanctum', 'verified', 'admin', 'setup.complete']);
+        $middleware->api(append: [ForceJsonResponse::class]);
+        $middleware->trustProxies(at: '*');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(