<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use App\Services\ScopedPortalAdministration;

final class EnsureScopedPortalAdministration
{
    public function handle(Request $request, Closure $next): Response
    {
        $actor=$request->user();abort_unless($actor,403);
        $scope=app(ScopedPortalAdministration::class);
        $path=$request->path();
        $interests=$request->is('management/interests','management/interests/*','api/v1/investment/admin/interests/*');
        // Exact areas of P1; unrelated management, fiscal rules and private records keep their gate.
        $catalogue=$request->is('management/economic-references/lot-01','management/economic-references/lot-01/*',
            'management/education','management/education/*','management/investment/references','management/investment/references/*','api/v1/investment/admin/references','api/v1/investment/admin/references/*',
            'management/investment/zones','management/investment/zones/*','api/v2/investment/admin/zones','api/v2/investment/admin/zones/*',
            'management/balcao/atribuicoes','management/balcao/atribuicoes/*','management/balcao/servicos',
            'management/balcao/fontes') || ($request->isMethod('GET') && $path==='management/balcao-install');
        $allowed=$interests ? $scope->interestOperator($actor) : ($catalogue && $scope->administrative($actor));
        abort_unless($allowed || ($actor->can('manage-portal') && !app(\App\Services\PortalProfileAccess::class)->has($actor,'auditor')),403,'Acesso reservado ao âmbito já designado.');
        $response=$next($request);
        if (!$request->isMethod('GET') && $response->getStatusCode()<400) {
            app(\App\Services\PortalProfileAccess::class)->audit($actor,'scoped_administration',[
                'method'=>$request->method(),'route'=>$request->route()?->uri(),'scope'=>$interests?'assigned-interest':'catalogue-administration']);
        }
        return $response;
    }
}