<?php

namespace App\Http\Middleware;

use App\Models\DirectoryUser;
use App\Models\Tenant;
use App\Services\Auth\EntraTokenValidator;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use RuntimeException;
use Symfony\Component\HttpFoundation\Response;

/** Authentifie les appels de l'add-in (Bearer = jeton Entra obtenu par NAA). */
class AuthenticateEntraToken
{
    public function __construct(private readonly EntraTokenValidator $validator) {}

    public function handle(Request $request, Closure $next): Response
    {
        $token = $request->bearerToken();
        if (! $token) {
            return response()->json(['error' => 'unauthenticated'], 401);
        }

        try {
            $claims = $this->validator->validate($token);
        } catch (RuntimeException $e) {
            Log::notice('Jeton add-in refusé', ['reason' => $e->getMessage(), 'ip' => $request->ip()]);

            return response()->json(['error' => 'invalid_token'], 401);
        }

        $tenant = Tenant::where('entra_tenant_id', $claims['tid'])->first();
        $user = DirectoryUser::where('tenant_id', $tenant->id)->where('entra_oid', $claims['oid'])->first();
        if (! $user || ! $user->account_enabled) {
            // Agent pas encore synchronisé (compte créé depuis moins de 15 min) ou désactivé.
            return response()->json(['error' => 'unknown_user'], 404);
        }

        $request->attributes->set('entra_claims', $claims);
        $request->attributes->set('directory_user', $user);

        return $next($request);
    }
}