<?php

namespace App\Http\Middleware;

use App\Services\PortalProfileAccess;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Symfony\Component\HttpFoundation\Response;

class ProtectPrivilegedIdentity
{
    public function handle(Request $request, Closure $next): Response
    {
        $actor = $request->user();
        $access = app(PortalProfileAccess::class);
        if (! $actor || ! $access->governanceAvailable()) {
            return $next($request);
        }
        if (! in_array($request->method(), ['GET', 'HEAD', 'OPTIONS'], true) && $access->has($actor, 'auditor')
            && $request->is('management/*', 'api/v1/investment/admin/*', 'api/v2/investment/admin/*')) {
            $access->audit($actor, 'auditor_administrative_write_denied', ['method' => $request->method(), 'path' => $request->path()]);
            abort(403, 'Auditor só permite leitura administrativa, mesmo com outro papel ou permissão legada.');
        }
        $mandatoryMfa = $access->superuser($actor) || $access->has($actor, 'validator') || $access->has($actor, 'publisher');
        $denied = $request->isMethod('DELETE') && $request->is('user/two-factor-authentication') && $mandatoryMfa;
        $denied = $denied || ($access->superuser($actor) && $request->is('settings/profile') && $request->isMethod('PATCH')
            && $request->has('email') && $request->input('email') !== $actor->email);
        if ($request->isMethod('DELETE') && $request->is('settings/profile')) {
            $denied = $denied || $access->superuser($actor)
                || DB::table('portal_role_assignments')->where('user_id', $actor->id)->orWhere('approved_by', $actor->id)->exists()
                || DB::table('portal_profile_requests')->where('user_id', $actor->id)->orWhere('decided_by', $actor->id)->exists();
        }
        if ($denied) {
            $access->audit($actor, 'privileged_identity_change_denied', ['method' => $request->method(), 'path' => $request->path()]);
            abort(403, 'Esta alteração removeria MFA obrigatório, um titular ou histórico de autorização. Use revogação ou substituição controlada; não desative MFA para recuperar acesso.');
        }

        return $next($request);
    }
}