<?php

namespace App\Http\Middleware;

use App\Services\Softphone\SoftphoneIntegrationSettings;
use Closure;
use Illuminate\Http\Request;

/**
 * CORS for the browser-facing Softphone session endpoint: allows only the
 * configured client origin, with credentials.
 */
class SoftphoneIntegrationCors
{
    protected $settings;

    public function __construct(SoftphoneIntegrationSettings $settings)
    {
        $this->settings = $settings;
    }

    public function handle(Request $request, Closure $next)
    {
        $origin = $request->headers->get('Origin');

        if ($request->getMethod() === 'OPTIONS') {
            $response = response()->noContent();
            $response->headers->set('Access-Control-Allow-Methods', 'POST, OPTIONS');
            $response->headers->set(
                'Access-Control-Allow-Headers',
                'Authorization, Content-Type, Accept, X-Requested-With'
            );
            $response->headers->set('Access-Control-Max-Age', '600');
        } else {
            $response = $next($request);
        }

        $response->headers->set('Vary', 'Origin');

        if ($origin === null || trim($origin) === '') {
            return $response;
        }

        $isPreflight = $request->getMethod() === 'OPTIONS';

        if ($isPreflight || $this->originIsAllowedForAuthenticatedUser($request, $origin)) {
            $response->headers->set('Access-Control-Allow-Origin', $origin);
            $response->headers->set('Access-Control-Allow-Credentials', 'true');
        }

        return $response;
    }

    /**
     * Resolve the requesting user's company (set by the downstream auth
     * middleware) and check the origin against that company's allow-list.
     */
    private function originIsAllowedForAuthenticatedUser(Request $request, string $origin): bool
    {
        $user = $request->user();

        if (!$user || !$user->company_id) {
            return false;
        }

        return $this->settings->isOriginAllowed((int) $user->company_id, $origin);
    }
}