<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

class EnsureAdmin
{
    /**
     * Only operators with the console.view capability may reach the admin
     * console. Checked on the operator guard explicitly, never on the default
     * (`web`) guard's user — a portal account can no longer hold a role at all,
     * so trusting the default guard here would just mean nobody ever gets in.
     */
    public function handle(Request $request, Closure $next): Response
    {
        $operator = Auth::guard('operator')->user();

        abort_unless($operator !== null && $operator->isActive() && $operator->can('console.view'), 403);

        return $next($request);
    }
}