<?php

namespace App\Shared\Context;

use Illuminate\Http\Request;

final class RequireModuleContext
{
    public function check(Request $request, CompanyContext $context): void
    {
        $owner = ModuleNavigation::owner($request->path());
        if ($owner === null) return;
        $selected = $request->session()->get('company_context', []);
        $active = $selected['module_id'] ?? null;
        abort_unless($active, 409, 'Seleccione explicitamente um módulo antes de abrir este percurso.');
        $available = array_column(app(ModuleNavigation::class)->available($context), 'id');
        abort_unless(in_array($active, $available, true), 403, 'O acesso ao módulo foi revogado ou a configuração mudou.');
        $shared = $request->is('api/a/*','api/b1/*','api/document-preview/draft/*','api/document-preview/history/*','api/document-preparation/*');
        abort_unless($active === $owner || $shared, 409, 'Este percurso pertence a outro módulo. Mude de módulo antes de o abrir.');
        $request->attributes->set('sgf_module',$active);
        // Reads also carry the generation: stale tabs and late requests cannot mix contexts.
        // Standalone HTML pages use the current session; their APIs must carry the token.
        if ($request->is('api/*') && !$request->is('api/service-invoices/*/pdf')) {
            abort_unless(hash_equals($selected['token'] ?? '', (string)$request->header('X-SGF-Context')), 409, 'O contexto mudou. Reabra este percurso.');
        }
    }
}