<?php

namespace App\Http\Middleware;

use App\Services\DocumentManagementAccess;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureDocumentManagement
{
    public function handle(Request $request, Closure $next): Response
    {
        $actor = $request->user();
        abort_unless($actor !== null, 403);
        $access = app(DocumentManagementAccess::class);
        if ($access->full($actor)) {
            return $next($request); // Preserve existing management controls.
        }
        $allowed = $access->limited($actor) || $access->editorial($actor);
        $access->audit($actor, $allowed ? 'document_access_allowed' : 'document_access_denied', [
            'scope' => $access->editorial($actor) ? 'approved-editorial-catalogue-and-own-files' : 'own-portal-services-files', 'method' => $request->method(), 'path' => $request->path(),
        ]);
        abort_unless($allowed, 403, 'O acesso documental exige autorização, email confirmado e autenticação MFA nesta sessão.');

        return $next($request);
    }
}