<?php

declare(strict_types=1);

namespace App\Http\Middleware;

use App\Constants\ErrorCode;
use App\Models\Admin;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

class AdminAuthenticate
{
    public function handle(Request $request, Closure $next): Response
    {
        // 检查是否已登录
        if (!Auth::guard('admin')->check()) {
            return response()->json([
                'error' => ErrorCode::UNAUTHORIZED,
                'message' => '未授权，请先登录。',
            ], Response::HTTP_UNAUTHORIZED);
        }

        /** @var Admin $admin */
        $admin = Auth::guard('admin')->user();

        // 检查是否是有效的管理员
        if (!$admin->isValidAdmin()) {
            return response()->json([
                'error' => ErrorCode::FORBIDDEN,
                'message' => '无权访问管理员资源。',
            ], Response::HTTP_FORBIDDEN);
        }

        // 检查资源访问权限
        if (!$this->checkResourcePermission($request, $admin)) {
            return response()->json([
                'error' => ErrorCode::FORBIDDEN,
                'message' => '无权访问该资源。',
            ], Response::HTTP_FORBIDDEN);
        }

        // Add admin information to the request
        $request->merge(['admin' => $admin]);

        return $next($request);
    }

    /**
     * 检查管理员是否有权限访问请求的资源
     */
    private function checkResourcePermission(Request $request, Admin $admin): bool
    {
        // 超级管理员可以访问所有资源
        if ($admin->isSuperAdmin()) {
            return true;
        }

        // 获取路由参数
        $clientId = $request->route('client') ?? $request->route('id');
        $providerId = $request->route('llm_provider') ?? $request->route('id');

        // 检查客户管理权限
        if ($clientId && str_contains($request->path(), 'clients')) {
            return $admin->canManageClient((int)$clientId);
        }

        // 检查LLM提供商管理权限
        if ($providerId && str_contains($request->path(), 'llm-providers')) {
            return $admin->canManageLlmProvider((int)$providerId);
        }

        // 默认允许访问其他资源
        return true;
    }
}