<?php

// Registered only by the router after its actual isolated-database guard.
use App\Models\User;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class PortalQaAccountSelection
{
    public const MESSAGE = 'Este ambiente QA aceita apenas contas sintéticas de ensaio. Para os cenários A/B, use a conta QA 18 e o respetivo MFA. As contas restauradas são preservadas e não devem ser usadas neste ensaio.';

    public function handle(Request $request, Closure $next): Response
    {
        if (! config('portal.qa_synthetic_accounts_only', false) || ! app()->environment('testing')) {
            return $next($request);
        }
        $email = null;
        if ($request->isMethod('POST') && $request->is('login')) {
            $email = $request->input('email');
        } elseif ($request->is('two-factor-challenge') && $request->session()->has('login.id')) {
            $email = User::find($request->session()->get('login.id'))?->email;
        }
        if (is_string($email) && ! str_ends_with(strtolower($email), '@example.invalid')) {
            $request->session()->forget(['login.id', 'login.remember']);
            $request->attributes->set('qa_restored_account_rejected', true);
            if ($request->expectsJson()) {
                return response()->json(['message' => self::MESSAGE, 'errors' => ['email' => [self::MESSAGE]]], 422)
                    ->header('Cache-Control', 'no-store');
            }

            return redirect()->route('login')->withErrors(['email' => self::MESSAGE])->header('Cache-Control', 'no-store');
        }

        return $next($request);
    }
}