<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    public function register(): void
    {
        //
    }

    public function boot(): void
    {
        // Throttle the ad-unlock endpoints to blunt scripted abuse. Keyed by
        // user id when authenticated, otherwise by guest id + IP.
        RateLimiter::for('unlock', function (Request $request) {
            $key = $request->user()?->id
                ?? ($request->header('X-Guest-Id') . '|' . $request->ip());

            return [
                Limit::perMinute(30)->by('unlock:' . $key),
                Limit::perMinute(120)->by('unlock-ip:' . $request->ip()),
            ];
        });
    }
}
