<?php

namespace App\Http\Middleware;

use App\Models\LegalDocument;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Blocks access until the user accepted all current legal documents.
 *
 * Implements the LGPD requirement that the Terms of Use, Privacy Policy
 * and Cookie Policy must be accepted on first access before the main
 * platform features can be used.
 */
class EnsureTermsAccepted
{
    /**
     * Handle an incoming request.
     *
     * @param  Closure(Request): (Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user();

        if ($user === null) {
            return $next($request);
        }

        $currentIds = LegalDocument::query()->where('is_current', true)->pluck('id');

        if ($currentIds->isEmpty()) {
            return $next($request);
        }

        $acceptedIds = $user->consents()->pluck('legal_document_id');
        $pending = $currentIds->diff($acceptedIds);

        if ($pending->isNotEmpty()) {
            if ($request->expectsJson()) {
                return response()->json([
                    'message' => __('legal.accept_required'),
                    'pending' => $pending->values(),
                ], 428);
            }

            return redirect()->route('terms.accept');
        }

        return $next($request);
    }
}