<?php

namespace App\Http\Middleware;

use App\Services\Auth\SupplierPortalAccess;
use App\Utilities\SidebarPermissions;
use Closure;
use Illuminate\Http\Request;

class EnsureLimitedDingTalkPageAccess
{
    public function handle(Request $request, Closure $next): mixed
    {
        $user = $request->user();
        $route = $request->route();
        if (! $user || ! SidebarPermissions::hasLimitedDingTalkAccess($user)) {
            return $next($request);
        }

        if (SupplierPortalAccess::isSupplierUser($user)) {
            if ($route?->named('logout', 'business.supplier-portal.home')) {
                return $next($request);
            }
            if ($route?->named('dashboard') && $route->hasParameter('company_id')) {
                return redirect()->route('business.supplier-portal.home', [
                    'company_id' => $route->parameter('company_id'),
                ]);
            }
            if ($route?->named('business.pages.show')
                && $route->parameter('section') === 'supplier-reconciliation'
                && $route->parameter('page') === 'supplier-data') {
                return $next($request);
            }
            foreach ($route?->gatherMiddleware() ?? [] as $middleware) {
                if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
                    && str_replace(',', '/', substr($middleware, strlen('business.page:'))) === SupplierPortalAccess::PAGE_KEY) {
                    return $next($request);
                }
            }

            abort(403, '当前账号没有该页面权限。');
        }

        if (! $route?->hasParameter('company_id')) {
            return $next($request);
        }

        // Keep the application entrance, sign-out and existing self-profile checks.
        if ($route->named('dashboard', 'logout', 'profile.edit', 'profile.update')) {
            return $next($request);
        }

        $allowed = SidebarPermissions::allowedKeys($user);
        $key = $route->parameter('section').'/'.$route->parameter('page');
        if (in_array($key, $allowed, true)) {
            return $next($request);
        }

        // The section and quote group are navigation containers for the three pages.
        if ($route->named('business.pages.show') && $route->parameter('section') === 'courier-payables'
            && in_array($route->parameter('page'), [null, 'courier-quote'], true)) {
            return $next($request);
        }

        // Dedicated detail, file and action routes declare their owning business page.
        foreach ($route->gatherMiddleware() as $middleware) {
            if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
                && in_array(str_replace(',', '/', substr($middleware, strlen('business.page:'))), $allowed, true)) {
                return $next($request);
            }
        }

        // Also deny legacy exports/previews that do not declare a page permission.
        abort(403, '当前账号没有该页面权限。');
    }
}