(def app
  (api
   (assoc api-config
          :middleware
          [;muuntaja.middleware/wrap-format
           [wrap-defaults (-> site-defaults
                              (assoc-in [:responses :not-modified-responses] true)
                              (assoc-in [:static :resources] resources-root)
                              (assoc-in [:security :anti-forgery] false)
                              (assoc-in [:security :frame-options] :deny)
                              (assoc-in [:security :ssl-redirect] (not (:dev env)))
                              (assoc-in [:security :hsts] (not (:dev env))))]
           [wrap-cors :access-control-allow-origin [#"\\*"] :access-control-allow-methods [:get :post :put :delete :patch]]
           wrap-reload])
   (context "/auth" []
     api-routes-login
     api-routes-password)

   (context "/api" []
     :header-params [authorization :- String]
     :middleware [[wrap-authentication config/backend]]
     api-routes-calendar
     api-routes-campaigns
     api-routes-companies
     api-routes-contacts
     api-routes-files
     api-routes-opportunities
     api-routes-reports
     api-routes-roles
     api-routes-tags
     api-routes-tasks
     api-routes-teams
     api-routes-users
     api-routes-overview360)
   (undocumented app-routes
                 (route/resources "/" {:root resources-root})
                 not-found-routes)))