<?php

namespace App\Http\Middleware;

use App\Models\User;
use App\Models\UserSession;
use App\Services\MaintenanceService;
use App\Support\MaintenancePolicy as Policy;
use Closure;
use Illuminate\Http\Request;

/** Assigned only to member routes, never the entire Laravel API group. */
class MemberMaintenance
{
    public function handle(Request $request, Closure $next)
    {
        if ($request->isMethod('OPTIONS')) return $next($request);
        $now = now()->getTimestamp();
        $platform = Policy::platform($request->header('Platform', $request->input('platform')));
        $language = Policy::language($request->header('lang', $request->input('lang'))) ?? 'vi';
        $service = new MaintenanceService();
        $rows = $service->runtimeRows($language);
        $row = Policy::select($rows, $platform, null, $now);
        if ($row === null) return $next($request);
        // Read-only session validation: blocked requests must not renew login activity.
        $token = $request->header('Authorization');
        if (is_string($token) && $token !== '') {
            $session = UserSession::where('token', $token)->where('expire_time', '>', $now)->first();
            if ($session && UserSession::validUntil($session->getAttributes()) > $now) {
                $user = User::where('user_id', $session->user_id)->first();
                $saved = $user && empty($user->delete_time) && !(int) ($user->is_banned ?? 0) ? Policy::language($user->language) : null;
                if ($saved && $saved !== $language) {
                    $language = $saved; $row = Policy::select($service->runtimeRows($language), $platform, null, $now);
                }
            }
        }
        // The rule may have been switched off between reads.
        if ($row === null) return $next($request);
        return response()->json(Policy::failure($row, $platform, $language, $now) + ['timestamp' => $now])->header('Cache-Control', 'no-store');
    }
}