<?php

declare(strict_types=1);

namespace App\Policies;

use App\Models\User;

class MediaPolicy extends ResourcePolicy
{
    protected function resource(): string
    {
        return 'media';
    }

    /**
     * Files arrive by being uploaded on a record, not by being created here.
     */
    public function create(User $user): bool
    {
        return false;
    }

    /**
     * Uploading through the API, which has no form to attach a file to.
     *
     * Still true to the rule above in spirit: an upload says which kind of
     * record it is for — a page, a technology — and whoever may write that kind
     * of record may upload its image. Nobody else, whatever their `media.*`
     * permissions, which only ever described looking after files that already
     * exist.
     */
    public function upload(User $user, string $for = 'pages'): bool
    {
        return $user->can("{$for}.create") || $user->can("{$for}.update");
    }

    /**
     * A file something still points at cannot be deleted from here: doing so
     * would leave a broken image on the public site, which is precisely what
     * the health check exists to complain about.
     */
    public function delete(User $user, $model): bool
    {
        return parent::delete($user, $model) && ! $model->isReferenced();
    }
}