<?php

namespace App\Http\Middleware;

use App\Support\Settings;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

/**
 * Two-factor for operators, when the owner has made it compulsory.
 *
 * Off by default. The settings page itself is exempt, because it is where the
 * operator sets two-factor up — gating it would leave nobody able to satisfy
 * the requirement.
 */
class RequireOperatorTwoFactor
{
    public function handle(Request $request, Closure $next): Response
    {
        if (! Settings::bool('console.require_2fa', false)) {
            return $next($request);
        }

        $operator = Auth::guard('operator')->user();

        if ($operator === null || $operator->two_factor_confirmed_at !== null) {
            return $next($request);
        }

        // The one page that must stay reachable: where two-factor is enrolled.
        if (\App\Support\AdminArea::routeIs('admin.settings') || $request->routeIs('admin.logout')) {
            return $next($request);
        }

        return redirect()->route('admin.settings')
            ->with('status', __('admin_settings.two_factor_required'));
    }
}