<?php

namespace App\Http\Middleware;

use App\Services\TwoFactorService;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureCompanyTwoFactorEnrolled
{
    public function __construct(
        protected TwoFactorService $twoFactor
    ) {}

    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user();

        if (! $user || ($user->is_superadmin ?? false) || ! $user->company_id) {
            return $next($request);
        }

        if (! $this->twoFactor->mustEnroll($user)) {
            return $next($request);
        }

        if ($request->routeIs([
            'settings.profile',
            'settings.profile.two-factor.enable',
            'settings.profile.two-factor.enable-totp',
            'two-factor.enroll',
            'two-factor.enroll.email',
            'two-factor.enroll.totp',
            'logout',
            'api.auth.logout',
            'api.auth.user',
        ])) {
            return $next($request);
        }

        if ($request->expectsJson() || $request->is('api/*')) {
            return response()->json([
                'message' => 'Your company requires two-factor authentication. Enroll before continuing.',
                'enrollment_required' => true,
            ], 403);
        }

        return redirect()
            ->to(route('settings.profile') . '#security')
            ->with('error', 'Your company requires two-factor authentication. Set it up under Security before continuing.');
    }
}