app/bootstrap/app.php

<?php

use App\Http\Middleware\ForceJsonResponse;
use App\Http\Middleware\RequireSaasMode;
use App\Http\Middleware\RequireSubscription;
use App\Services\OutputService;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Illuminate\Validation\ValidationException;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
        then: function () {
            Route::middleware('web')
                ->group(base_path('routes/web/subscription.php'));
        },
    )
    ->withMiddleware(function (Middleware $middleware) {
        // Apply ForceJsonResponse only to API routes
        $middleware->api(ForceJsonResponse::class);

        $middleware->alias([
            'subscription' => RequireSubscription::class,
            'saas' => RequireSaasMode::class,
        ]);

        // Exclude Stripe webhook from CSRF verification
        $middleware->validateCsrfTokens(except: [
            'stripe/webhook',
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions) {
        $exceptions->shouldRenderJsonWhen(function (Request $request, Throwable $e) {
            if ($request->is('api/*')) {
                return true;
            }

            return $request->expectsJson();
        });

        /** @var OutputService $outputService */
        $outputService = resolve(OutputService::class);

        $exceptions->render(function (ValidationException $e, Request $request) use ($outputService) {
            if ($request->is('api/*') || $request->expectsJson()) {
                return response()->json(
                    $outputService->response(false, null, [$e->getMessage()]),
                    404
                );
            }
        });

        $exceptions->render(function (NotFoundHttpException $e, Request $request) use ($outputService) {
            if ($request->is('api/*') || $request->expectsJson()) {
                return response()->json(
                    $outputService->response(false, null, ['MODEL_NOT_FOUND']),
                    404
                );
            }
        });

        $exceptions->render(function (AccessDeniedHttpException $e, Request $request) use ($outputService) {
            if ($request->is('api/*') || $request->expectsJson()) {
                return response()->json(
                    $outputService->response(false, null, [$e->getMessage()]),
                    403
                );
            }
        });
    })
    ->create();