/**
 * Top-level Astro middleware composition.
 *
 * Order: shareAttribution → rateLimit → edgeCache → i18n → securityHeaders →
 *        sentryMiddleware → locale → localePrefix → session → csrf → services
 *
 * shareAttributionMiddleware and rateLimitMiddleware run BEFORE edgeCache so
 * the __sh first-touch attribution cookie and the anon `multideal_anon_sid`
 * cookie are set even on edge-cache HITs. Edge cache short-circuits on HIT
 * without calling next(), which would skip any middleware that runs after it;
 * a cache-hit visitor with no anon sid would then fail the /api/ws handshake
 * (401) forever. Edge-cache strips Set-Cookie from stored/coalesced copies, so
 * per-visitor cookies never leak into the shared cache.
 *
 * edgeCache runs SECOND so unauth GET hits on cacheable public routes
 * (/deal/{uuid}, /deals/all, /category/*, /search, …) short-circuit before
 * the expensive session/CSRF/locale work. On a cache miss the response
 * unwinds back through edgeCache after all downstream middleware applied
 * their headers — so what we cache is the fully-headered final response.
 * See edge-cache.ts for the full correctness contract.
 *
 * Per-route rate-limit checks continue to live in
 * `src/server/auth/rate-limit-check.ts` (scopes defined in
 * `src/server/auth/rate-limit-policies.ts`).
 *
 * Sentry is initialized as early as possible (after security headers which
 * don't depend on it) so errors in subsequent middleware are captured.
 *
 * CSRF middleware runs after session so locals.session is populated.
 *
 * Services middleware runs after CSRF so all session/auth context is available
 * before any route handler accesses locals.services.
 */

import { sequence } from 'astro:middleware';
import { botProbeBlock } from '@/server/middleware/bot-probe-block.js';
import { edgeCacheMiddleware } from '@/server/middleware/edge-cache.js';
import { i18nMiddleware } from '@/server/middleware/i18n.js';
import { securityHeaders } from '@/server/middleware/security-headers.js';
import { localeMiddleware } from '@/server/middleware/locale.js';
import { localePrefixMiddleware } from '@/server/middleware/locale-prefix.js';
import { sessionMiddleware } from '@/server/middleware/session.js';
import { sentryMiddleware } from '@/server/middleware/sentry.js';
import { csrfMiddleware } from '@/server/middleware/csrf.js';
import { servicesMiddleware } from '@/server/middleware/services.js';
import { rateLimitMiddleware } from '@/server/middleware/rate-limit.js';
import { shareAttributionMiddleware } from '@/server/middleware/share-attribution.js';
import { launchRobots } from '@/server/middleware/launch-robots.js';

export const onRequest = sequence(
  launchRobots,
  botProbeBlock,
  shareAttributionMiddleware,
  rateLimitMiddleware,
  edgeCacheMiddleware,
  i18nMiddleware,
  securityHeaders,
  sentryMiddleware,
  localeMiddleware,
  localePrefixMiddleware,
  sessionMiddleware,
  csrfMiddleware,
  servicesMiddleware,
);