<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use Illuminate\Support\Facades\Auth;
use Modules\ContractorManagement\Models\Contractor;

class CheckContractorHierarchy
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        if (!Auth::check()) {
            return redirect()->route('login');
        }

        $user = Auth::user();

        // admin bypasses hierarchy checks
        if ($user->hasRole('admin')) {
            return $next($request);
        }

        // For routes that specify a contractor, ensure the user has access
        $targetContractorId = $request->route('contractor') ?? $request->input('contractor_id');

        if ($targetContractorId) {
            $targetContractorId = (int) $targetContractorId;

            if ($user->contractor_id === $targetContractorId) {
                return $next($request);
            }

            // Check if user is Main Contractor trying to access their Sub Contractor
            $contractor = $user->contractor;
            if ($contractor && $contractor->type === 'main') {
                $isSub = Contractor::where('id', $targetContractorId)
                    ->where('parent_id', $user->contractor_id)
                    ->exists();

                if ($isSub) {
                    return $next($request);
                }
            }

            abort(403, 'Unauthorized access to contractor data.');
        }

        return $next($request);
    }
}