Errors and Status Codes

<?php
// bootstrap/app.php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->throttleApi();
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        // Laravel's default 404 message names the model class it could not
        // find. Clients do not need that.
        $exceptions->render(function (NotFoundHttpException $e, Request $request) {
            if ($request->is('api/*')) {
                return response()->json(['message' => 'Resource not found.'], 404);
            }

            // Returning nothing falls through to the default rendering.
        });

        // The handler rewrites an Illuminate\Auth\Access\AuthorizationException
        // into Symfony's AccessDeniedHttpException before any render callback
        // runs, so that is the type to match on. A callback type-hinted on
        // AuthorizationException is never reached.
        $exceptions->render(function (AccessDeniedHttpException $e, Request $request) {
            if ($request->is('api/*')) {
                return response()->json([
                    'message' => 'This action is not allowed for your token.',
                ], 403);
            }
        });

        // Runs for every response the handler builds. Add the machine-readable
        // code clients branch on, without touching any status code.
        $exceptions->respond(function (Response $response, Throwable $e, Request $request) {
            if (! $request->is('api/*') || ! $response->isClientError()) {
                return $response;
            }

            $payload = json_decode($response->getContent(), true) ?: [];
            $payload['code'] = class_basename($e);

            return response()->json($payload, $response->getStatusCode());
        });

        // Expected, noisy, and not worth a log line.
        $exceptions->dontReport([
            \App\Exceptions\PaymentDeclinedException::class,
        ]);
    })->create();