<?php

namespace App\Modules\Identity\Http;

use Closure;
use Illuminate\Http\Request;

final class RequireValidSession
{
    public function handle(Request $request, Closure $next)
    {
        abort_unless($request->user(), 401);
        if ((int) $request->session()->get('auth_version', 0) !== (int) $request->user()->auth_version) {
            auth()->logout();
            $request->session()->invalidate();
            $request->session()->regenerateToken();
            abort(401, 'Sessão terminada. Entre novamente.');
        }
        $response = $next($request);
        $response->headers->set('Cache-Control', 'no-store');
        return $response;
    }
}