<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
/** Environment reservation is not a portal identity or a business permission. */
class EnsureHomologationAccess
{
 public function handle(Request $request, Closure $next): Response
 {
  if (!config('portal.homologation_only', false)) return $next($request);
  $mode=config('portal.homologation_access_mode', 'reviewers');
  if ($mode==='perimeter') {
   // Set only by the trusted server after its environment-access check.
   // A client HTTP_INVESTMOZ_* header is deliberately not accepted.
   abort_unless($request->server('INVESTMOZ_HOMOLOGATION_ACCESS')==='granted',403,
    'Este ambiente de homologação tem acesso reservado à Tempo.');
   $response=$next($request);
   $response->headers->set('Cache-Control','private, no-store');
   $response->headers->set('X-Robots-Tag','noindex, nofollow, noarchive');
   return $response;
  }
  abort_unless($mode==='reviewers',503,'A reserva da homologação não está configurada.');
  // Compatibility until an independent perimeter is explicitly configured.
  if ($request->is('login','logout','register','forgot-password','reset-password','reset-password/*',
    'email/verify','email/verify/*','email/verification-notification','two-factor-challenge',
    'user/confirm-password','user/confirmed-password-status','user/two-factor-*',
    'settings/security','settings/password','user/password','passkeys/*','user/passkeys/*','up')) return $next($request);
  $actor=$request->user();
  if (!$actor) return $request->expectsJson()
   ? response()->json(['message'=>'Entre na conta autorizada para homologação.'],401)
   : redirect()->guest(route('login'));
  abort_unless($actor->hasVerifiedEmail() && in_array(strtolower(trim($actor->email)),config('portal.homologation_reviewers',[]),true),403,
   'Esta homologação está reservada às contas indicadas pela Tempo.');
  $response=$next($request);$response->headers->set('Cache-Control','private, no-store');return $response;
 }
}