<?php

namespace Modules\Api\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Modules\Api\Models\ApiToken;
use Symfony\Component\HttpFoundation\Response;

final class AuthenticateApiToken
{
    public function handle(Request $r, Closure $next, ?string $ability = null): Response
    {
        $plain = $r->bearerToken();
        if (! $plain) {
            return response()->json(['message' => 'Unauthenticated.'], 401);
        }$token = ApiToken::with('user')->where('token', hash('sha256', $plain))->first();
        if (! $token || ($token->expires_at && $token->expires_at->isPast()) || ! $token->user) {
            return response()->json(['message' => 'Invalid or expired API token.'], 401);
        }if ($ability && ! $token->allows($ability)) {
            return response()->json(['message' => 'Insufficient token ability.'], 403);
        }$token->update(['last_used_at' => now()]);
        auth()->setUser($token->user);
        $r->attributes->set('apiToken', $token);

        return $next($r);
    }
}