<?php

namespace App\Http\Middleware;

use App\Models\SyncToken;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Symfony\Component\HttpFoundation\Response;

class EnsureValidSyncToken
{
    public function handle(Request $request, Closure $next): Response
    {
        $bearerToken = $request->bearerToken();

        if (! $bearerToken) {
            return response()->json([
                'success' => false,
                'message' => 'Token sinkronisasi tidak ditemukan.',
            ], 401);
        }

        $token = SyncToken::query()
            ->whereNull('revoked_at')
            ->get()
            ->first(fn (SyncToken $item) => Hash::check($bearerToken, $item->token_hash));

        if (! $token) {
            return response()->json([
                'success' => false,
                'message' => 'Token sinkronisasi tidak valid atau sudah dinonaktifkan.',
            ], 401);
        }

        $token->forceFill([
            'last_used_at' => now(),
        ])->save();

        $request->attributes->set('syncToken', $token);

        return $next($request);
    }
}