<?php

declare(strict_types=1);

namespace App\Middlewares;

use Core\Middleware;
use Core\Request;
use Core\Response;
use Core\Database;
use PDO;

class AuthMiddleware extends Middleware
{
    public function handle(Request $request, callable $next): void
    {
        $authHeader = $request->getHeader('authorization');
        if (empty($authHeader) || !str_starts_with($authHeader, 'Bearer ')) {
            Response::unauthorized('Bearer token required in Authorization header.');
        }

        $token = substr($authHeader, 7);
        $userId = $request->getHeader('x-user-id');

        try {
            $pdo = Database::getConnection();
            $stmt = $pdo->prepare('
                SELECT u.id, u.phone, u.full_name, u.role, u.status, us.last_token
                FROM users u
                JOIN user_security us ON us.user_id = u.id
                WHERE u.id = :user_id AND us.last_token = :token
                LIMIT 1
            ');
            $stmt->execute([
                ':user_id' => $userId,
                ':token' => $token,
            ]);
            $user = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$user) {
                Response::unauthorized('Invalid or expired authentication session token.');
            }

            if ($user['status'] !== 'ACTIVE' && $user['status'] !== 'PENDING_VERIFICATION') {
                Response::forbidden('User account is not currently active.');
            }

        } catch (\Throwable $e) {
            Response::error('Authentication verification failure: ' . $e->getMessage(), 500);
        }

        $next($request);
    }
}