<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureTwoFactorAuthenticationIsEnabled
{
    /**
     * Require authenticated users to finish two-factor enrollment when configured.
     */
    public function handle(Request $request, Closure $next): Response
    {
        if (! config('auth-ui.features.two_factor')
            || ! config('auth-ui.features.two_factor_required')
            || ! $request->user()
            || $request->user()->hasEnabledTwoFactorAuthentication()
            || $this->isEnrollmentRoute($request)) {
            return $next($request);
        }

        if ($request->expectsJson()) {
            return response()->json([
                'message' => 'Two-factor authentication setup is required.',
                'setup_url' => route('two-factor.setup'),
            ], 403);
        }

        if ($request->isMethod('GET')) {
            $request->session()->put('url.intended', $request->fullUrl());
        }

        return redirect()->route('two-factor.setup')
            ->with('error', 'Two-factor authentication is required before you can continue.');
    }

    private function isEnrollmentRoute(Request $request): bool
    {
        return $request->routeIs([
            'two-factor.setup*',
            'logout',
            'verification.*',
        ]);
    }
}