<?php

namespace App\Http\Middleware;

use App\Services\PortalProfileAccess;
use App\Services\ScopedPortalAdministration;
use App\Services\SimulationTaxGovernanceAccess;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

final class EnsureScopedPortalAdministration
{
    public function handle(Request $request, Closure $next): Response
    {
        $actor = $request->user();
        abort_unless($actor !== null, 403);
        $scope = app(ScopedPortalAdministration::class);
        $path = $request->path();
        $interests = $request->is('management/interests', 'management/interests/*', 'api/v1/investment/admin/interests/*');
        // Fiscal maintenance reuses authorised administration; unrelated gates remain unchanged.
        $geometryRead = $request->isMethod('GET') && $path === 'management/territory-geometries';
        $catalogue = $geometryRead || $request->is('management/territory-geometry-import', 'management/territory-geometry-import/*',
            'management/economic-references/lot-01', 'management/economic-references/lot-01/*',
            'management/education', 'management/education/*', 'management/investment/references', 'management/investment/references/*', 'api/v1/investment/admin/references', 'api/v1/investment/admin/references/*',
            'management/investment/zones', 'management/investment/zones/*', 'api/v2/investment/admin/zones', 'api/v2/investment/admin/zones/*',
            'management/balcao/atribuicoes', 'management/balcao/atribuicoes/*', 'management/balcao/servicos',
            'management/balcao/fontes') || ($request->isMethod('GET') && $path === 'management/balcao-install');
        $fiscal = $request->is('api/v2/investment/admin/tax-rules', 'api/v2/investment/admin/tax-rules/*',
            'api/v2/investment/admin/tax-rule-sources', 'management/investment/tax-rules/*');
        $allowed = ($fiscal && SimulationTaxGovernanceAccess::maintainer($actor)) || ($interests ? $scope->interestOperator($actor) : ($catalogue && $scope->administrative($actor)));
        abort_unless($allowed || ($actor->can('manage-portal') && ! app(PortalProfileAccess::class)->has($actor, 'auditor')), 403, 'Acesso reservado ao âmbito já designado.');
        $response = $next($request);
        if (! $request->isMethod('GET') && $response->getStatusCode() < 400) {
            app(PortalProfileAccess::class)->audit($actor, 'scoped_administration', [
                'method' => $request->method(), 'route' => $request->route()?->uri(), 'scope' => $fiscal ? 'fiscal-maintenance' : ($interests ? 'assigned-interest' : 'catalogue-administration')]);
        }

        return $response;
    }
}