<?php

namespace App\Http\Middleware;

use Closure;
use App\Models\AdminUser;
use App\Lottery\ErrorCode;
use App\Support\ApiResponse;
use Illuminate\Http\Request;
use Laravel\Sanctum\PersonalAccessToken;
use Symfony\Component\HttpFoundation\Response;

/**
 * 后台 API：`auth:sanctum` 之后执行，校验为 {@link AdminUser} 且未禁用；
 * 上下文可通过 `$request->lotteryAdmin()` 读取。
 */
final class EnsureAdminApi
{
    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user();

        if (! $user instanceof AdminUser) {
            return ApiResponse::error(
                trans('admin.unauthenticated', [], $request->lotteryLocale()),
                ErrorCode::AdminUnauthenticated->value,
                null,
                401,
            );
        }

        if ((int) $user->status !== 0) {
            return ApiResponse::error(
                trans('admin.account_disabled', [], $request->lotteryLocale()),
                ErrorCode::AdminAccountDisabled->value,
                null,
                403,
            );
        }

        $accessToken = $user->currentAccessToken();
        if (
            (int) $user->admin_session_version > 0
            && $accessToken instanceof PersonalAccessToken
            && $accessToken->name === 'admin-api'
        ) {
            $expectedAbility = 'admin-session:'.(int) $user->admin_session_version;
            $abilities = is_array($accessToken->abilities) ? $accessToken->abilities : [];

            if (! in_array($expectedAbility, $abilities, true)) {
                return ApiResponse::error(
                    trans('admin.session_replaced', [], $request->lotteryLocale()),
                    ErrorCode::AdminSessionReplaced->value,
                    null,
                    401,
                );
            }
        }

        $request->attributes->set('lottery_admin', $user);

        return $next($request);
    }
}