<?php

namespace App\Scopes;

use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Scope;

class TenantScope implements Scope
{
    public function apply(Builder $builder, Model $model): void
    {
        $user = auth()->user();

        if ($user === null) {
            // Default-deny: null-user must NEVER silently see all records
            // (prevents leaks in queue jobs, Tinker, etc.)
            $builder->whereRaw('0 = 1');
            return;
        }

        if ($user->hasRole('platform-admin')) {
            return; // platform-admin sees all tenants
        }

        $builder->where($model->getTable() . '.tenant_id', $user->tenant_id);
    }
}