<?php
namespace App\Services;

use App\Models\User;
use App\Models\InterestRequest;
use Illuminate\Support\Facades\DB;

/** Reuses approved administration; never changes the global gate or private-record ACL. */
final class ScopedPortalAdministration
{
    public function administrative(?User $actor): bool
    {
        if (!$actor || !$actor->hasVerifiedEmail()) return false;
        $access = app(PortalProfileAccess::class);
        if ($access->has($actor, 'auditor')) return false;
        return ($access->superuser($actor) && $access->mfa($actor))
            || ($access->legacyWriteAllowed($actor) && $access->mfa($actor));
    }

    public function interestOperator(?User $actor): bool
    {
        if (!$actor || !$actor->hasVerifiedEmail()) return false;
        $access=app(PortalProfileAccess::class);
        return !$access->has($actor,'auditor') && $access->mfa($actor)
            && ($this->administrative($actor) || DB::table('interest_requests')->where('assigned_to',$actor->id)->whereNull('deleted_at')->exists());
    }

    public function interest(User $actor, InterestRequest $record): bool
    {
        return $this->interestOperator($actor)
            && ($actor->can('manage-portal') || (int)$record->assigned_to===$actor->id);
    }

    public function interestQuery($query, User $actor): void
    {
        if (!$actor->can('manage-portal')) $query->where('assigned_to',$actor->id);
    }

    public function deskDecision(User $actor, object $request): bool
    {
        return $actor->can('manage-portal')
            || ($this->administrative($actor) && (int)$request->analyst_id===$actor->id);
    }

    public function deskCaseDecision(User $actor, string $id): bool
    {
        return $actor->can('manage-portal') || ($this->administrative($actor)
            && DB::table('desk_requests')->where('case_id',$id)->where('analyst_id',$actor->id)->exists());
    }
}