<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

/**
 * 计划任务 / 运维 URL 的共享密钥校验：?token= 或 X-Cron-Token 需与 CRON_TOKEN 一致；未配置 CRON_TOKEN 时一律拒绝
 */
class CronTokenMiddleware
{
    public function handle(Request $request, Closure $next)
    {
        $expected = (string)config('services.cron.token', '');
        $token = (string)($request->header('X-Cron-Token') ?: $request->query('token', ''));
        if ($expected === '' || !hash_equals($expected, $token)) {
            return response()->json([
                'code' => 403,
                'timestamp' => time(),
                'msg' => 'Forbidden',
                'data' => [],
            ], 403);
        }
        return $next($request);
    }
}