<?php

namespace App\Http\Middleware;

use App\Models\Customer;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

/**
 * Enforce customer account lifecycle on portal requests: a suspended or closed
 * customer must lose access. Admins are exempt, and an active impersonation
 * session is exempt so operators can still inspect a suspended customer's portal.
 */
class EnsureCustomerActive
{
    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user();

        if ($user !== null && ! $user->isOperator() && ! $request->session()->has('impersonator_id')) {
            $customer = Customer::query()->where('user_id', $user->id)->first()
                ?? Customer::query()->where('email', $user->email)->first();

            if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
                Auth::logout();
                $request->session()->invalidate();
                $request->session()->regenerateToken();

                $key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';

                return redirect()->route('login')->withErrors(['email' => __($key)]);
            }
        }

        return $next($request);
    }
}