<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/** Environment reservation is not a portal identity or a business permission. */
class EnsureHomologationAccess
{
    public function handle(Request $request, Closure $next): Response
    {
        if (! config('portal.homologation_only', false)) {
            return $next($request);
        }
        $mode = config('portal.homologation_access_mode', 'reviewers');
        if ($mode === 'perimeter') {
            // Set only by the trusted server after its environment-access check.
            // A client HTTP_INVESTMOZ_* header is deliberately not accepted.
            abort_unless($request->server('INVESTMOZ_HOMOLOGATION_ACCESS') === 'granted', 403,
                'Este ambiente de homologação tem acesso reservado à Tempo.');
            $response = $next($request);
            $response->headers->set('Cache-Control', 'private, no-store');
            $response->headers->set('X-Robots-Tag', 'noindex, nofollow, noarchive');

            return $response;
        }
        abort_unless($mode === 'reviewers', 503, 'A reserva da homologação não está configurada.');
        // Compatibility until an independent perimeter is explicitly configured.
        if ($request->is('login', 'logout', 'register', 'forgot-password', 'reset-password', 'reset-password/*',
            'email/verify', 'email/verify/*', 'email/verification-notification', 'two-factor-challenge',
            'user/confirm-password', 'user/confirmed-password-status', 'user/two-factor-*',
            'settings/security', 'settings/password', 'user/password', 'passkeys/*', 'user/passkeys/*', 'up')) {
            return $next($request);
        }
        $actor = $request->user();
        if (! $actor) {
            return $request->expectsJson()
             ? response()->json(['message' => 'Entre na conta autorizada para homologação.'], 401)
             : redirect()->guest(route('login'));
        }
        abort_unless($actor->hasVerifiedEmail() && in_array(strtolower(trim($actor->email)), config('portal.homologation_reviewers', []), true), 403,
            'Esta homologação está reservada às contas indicadas pela Tempo.');
        $response = $next($request);
        $response->headers->set('Cache-Control', 'private, no-store');

        return $response;
    }
}