<?php

namespace App\Http\Middleware;

use App\Utilities\SidebarPermissions;
use Closure;
use Illuminate\Http\Request;

class EnsureLimitedDingTalkPageAccess
{
    public function handle(Request $request, Closure $next): mixed
    {
        $user = $request->user();
        $route = $request->route();
        if (! $user || ! $route?->hasParameter('company_id') || ! SidebarPermissions::hasLimitedDingTalkAccess($user)) {
            return $next($request);
        }

        // Keep the application entrance, sign-out and existing self-profile checks.
        if ($route->named('dashboard', 'logout', 'profile.edit', 'profile.update')) {
            return $next($request);
        }

        $allowed = SidebarPermissions::allowedKeys($user);
        $key = $route->parameter('section').'/'.$route->parameter('page');
        if (in_array($key, $allowed, true)) {
            return $next($request);
        }

        // The section and quote group are navigation containers for the three pages.
        if ($route->named('business.pages.show') && $route->parameter('section') === 'courier-payables'
            && in_array($route->parameter('page'), [null, 'courier-quote'], true)) {
            return $next($request);
        }

        // Dedicated detail, file and action routes declare their owning business page.
        foreach ($route->gatherMiddleware() as $middleware) {
            if (is_string($middleware) && str_starts_with($middleware, 'business.page:')
                && in_array(str_replace(',', '/', substr($middleware, strlen('business.page:'))), $allowed, true)) {
                return $next($request);
            }
        }

        // Also deny legacy exports/previews that do not declare a page permission.
        abort(403, '当前账号没有该页面权限。');
    }
}