<?php

namespace App\Http\Middleware;

use App\Models\User;
use App\Services\OrganizationAccess;
use App\Services\RequisitionWorkflow;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureOrganizationAccess
{
    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user('web');
        if ($user instanceof User && $user->tenant_id !== null) {
            abort_unless(app(OrganizationAccess::class)->permissions($user) !== [], 403, 'Não existe uma atribuição de acesso válida. Contacte os administradores da empresa.');
            $contextSelection = $request->isMethod('POST') && $request->routeIs('work-context.select');
            abort_if(app(OrganizationAccess::class)->maintenanceOnly($user) && ! $request->isMethodSafe() && ! $contextSelection, 403, 'A manutenção temporária tem acesso de diagnóstico e consulta.');
        }

        $response = $next($request);
        if ($user instanceof User && app(OrganizationAccess::class)->maintenanceOnly($user)) {
            app(RequisitionWorkflow::class)->audit($user, 'maintenance.consulted', null, null, ['path' => $request->path(), 'status' => $response->getStatusCode()]);
        }

        return $response;
    }
}