<?php

namespace App\Http\Middleware;

use App\Services\DocumentManagementAccess;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureScopedEditorial
{
    public function handle(Request $request, Closure $next): Response
    {
        $actor = $request->user();
        abort_unless($actor !== null, 403);
        $access = app(DocumentManagementAccess::class);
        if ($access->full($actor)) {
            return $next($request);
        }
        abort_unless($access->editorial($actor), 403);
        $allowed = in_array($request->route()->getName(), ['editorial.edit', 'editorial.save', 'editorial.preview', 'editorial.preview-content', 'services.resource', 'services.resource.update'], true)
            || ($request->route()->getName() === 'services.moderate' && $request->route('type') === 'resources');
        abort_unless($allowed, 403);
        if ($request->route('id') !== null) {
            $access->assertEditableResource($actor, (int) $request->route('id'));
        }

        return $next($request);
    }
}