<?php

namespace App\Modules\Tenancy\Http;

use App\Modules\Identity\Domain\Enums\UserRole;
use App\Modules\Tenancy\Application\TenantContext;
use Closure;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

final readonly class EstablishTenantContext
{
    public function __construct(private TenantContext $tenantContext) {}

    public function handle(Request $request, Closure $next): Response
    {
        $user = $request->user();

        if (! $user) {
            return new JsonResponse(['error' => ['code' => 'unauthenticated', 'message' => 'Authentication is required.']], 401);
        }

        if ($user->role === UserRole::SuperAdmin) {
            return new JsonResponse(['error' => ['code' => 'tenant_context_not_applicable', 'message' => 'This endpoint requires an organization context.']], 403);
        }

        $organization = $user->organization;

        if (! $organization || $organization->status !== 'active') {
            return new JsonResponse(['error' => ['code' => 'organization_unavailable', 'message' => 'The organization is unavailable.']], 403);
        }

        $this->tenantContext->set($organization);

        return $next($request);
    }
}