<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

class EnforcePasswordChange
{
    /**
     * Intercept all requests for users with a temporary password.
     * Forces a redirect to the change-password page until resolved.
     */
    public function handle(Request $request, Closure $next): Response
    {
        if (Auth::check()) {
            $user = Auth::user();

            $isExemptRoute = $request->routeIs('password.change.form')
                || $request->routeIs('password.change.update')
                || $request->routeIs('logout');

            if ($user->must_change_password && ! $isExemptRoute) {
                return redirect()->route('password.change.form')
                    ->with('warning', 'You must set a new password before continuing.');
            }
        }

        return $next($request);
    }
}