<?php

namespace Modules\IntegrationHub\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Modules\IntegrationHub\Models\IhOdataToken;

class ODataTokenAuth
{
    public function handle(Request $request, Closure $next)
    {
        $token = $request->bearerToken()
            ?? $request->header('X-IntegrationHub-Token')
            ?? $request->query('access_token');

        if (empty($token)) {
            return response()->json(['error' => 'Missing API token'], 401);
        }

        $record = IhOdataToken::where('token_hash', IhOdataToken::hashToken($token))
            ->valid()
            ->first();

        if (! $record) {
            return response()->json(['error' => 'Invalid or expired token'], 401);
        }

        $dataset = $request->route('dataset');
        if ($dataset && ! $record->hasScope($dataset)) {
            return response()->json(['error' => 'Token does not have access to this dataset'], 403);
        }

        $request->attributes->set('ih_odata_token', $record);
        $request->attributes->set('ih_business_id', $record->business_id);

        return $next($request);
    }
}