<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Http;
use Symfony\Component\HttpFoundation\Response;

/**
 * App sessions are subordinate to the platform (auth.ladill.com) session.
 * When the platform session ends, clear this app's local session too.
 */
class EnsurePlatformSession
{
    public function handle(Request $request, Closure $next): Response
    {
        if (! Auth::check()) {
            return $next($request);
        }

        $authDomain = trim((string) config('app.auth_domain', ''));
        if ($authDomain === '') {
            return $next($request);
        }

        $cookieHeader = (string) $request->headers->get('Cookie', '');
        if ($cookieHeader === '') {
            return $this->clearAppSession($request);
        }

        try {
            $response = Http::withHeaders(['Cookie' => $cookieHeader])
                ->timeout(3)
                ->get('https://'.$authDomain.'/sso/ping');
        } catch (\Throwable) {
            return $next($request);
        }

        if ($response->status() === 401) {
            return $this->clearAppSession($request);
        }

        return $next($request);
    }

    private function clearAppSession(Request $request): Response
    {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect()->route('sso.connect', [
            'redirect' => $request->fullUrl(),
        ]);
    }
}