<?php

declare(strict_types=1);

namespace App\Providers;

use App\Models\Application;
use App\Models\Call;
use App\Models\Category;
use App\Models\Client;
use App\Models\Media;
use App\Models\Member;
use App\Models\MissingUrl;
use App\Models\Page;
use App\Models\Project;
use App\Models\Redirect;
use App\Models\Repository;
use App\Models\Service;
use App\Models\Talk;
use App\Models\Technology;
use App\Models\Testimonial;
use App\Models\User;
use App\Models\Webhook;
use App\Policies\ApplicationPolicy;
use App\Policies\CallPolicy;
use App\Policies\CategoryPolicy;
use App\Policies\ClientPolicy;
use App\Policies\MediaPolicy;
use App\Policies\MemberPolicy;
use App\Policies\MissingUrlPolicy;
use App\Policies\PagePolicy;
use App\Policies\ProjectPolicy;
use App\Policies\RedirectPolicy;
use App\Policies\RepositoryPolicy;
use App\Policies\RolePolicy;
use App\Policies\ServicePolicy;
use App\Policies\TalkPolicy;
use App\Policies\TechnologyPolicy;
use App\Policies\TestimonialPolicy;
use App\Policies\UserPolicy;
use App\Policies\WebhookPolicy;
use App\Support\Permissions;
use Illuminate\Support\Facades\Gate;
use Illuminate\Support\ServiceProvider;
use Spatie\Permission\Models\Role;

class AuthServiceProvider extends ServiceProvider
{
    public function boot(): void
    {
        Gate::policy(Page::class, PagePolicy::class);
        Gate::policy(Category::class, CategoryPolicy::class);
        Gate::policy(Project::class, ProjectPolicy::class);
        Gate::policy(Member::class, MemberPolicy::class);
        Gate::policy(Technology::class, TechnologyPolicy::class);
        Gate::policy(Call::class, CallPolicy::class);
        Gate::policy(Application::class, ApplicationPolicy::class);
        Gate::policy(Service::class, ServicePolicy::class);
        Gate::policy(Client::class, ClientPolicy::class);
        Gate::policy(Testimonial::class, TestimonialPolicy::class);
        Gate::policy(Talk::class, TalkPolicy::class);
        Gate::policy(Media::class, MediaPolicy::class);
        Gate::policy(Redirect::class, RedirectPolicy::class);
        Gate::policy(MissingUrl::class, MissingUrlPolicy::class);
        Gate::policy(Repository::class, RepositoryPolicy::class);
        Gate::policy(User::class, UserPolicy::class);
        Gate::policy(Role::class, RolePolicy::class);
        Gate::policy(Webhook::class, WebhookPolicy::class);

        // The one place a permission is granted — spatie's own gate check is
        // switched off (config/permission.php) so nothing answers before this.
        //
        // Super admins bypass every check. Granting the role this way rather
        // than by attaching every permission means the role can never fall
        // behind as the catalogue grows. Returning null (not false) when
        // nothing applies lets the normal policy chain run.
        //
        // A machine token narrows all of that: a permission must be one the
        // token was given *and* one its owner holds. A policy is not a
        // permission, so it runs as usual and asks for permissions, which come
        // back here.
        Gate::before(function (User $user, string $ability): ?bool {
            $token = $user->currentAccessToken();

            if ($token !== null) {
                if (! in_array($ability, Permissions::all(), true)) {
                    return null;
                }

                return $token->allows($ability)
                    && ($user->hasRole('super_admin') || $user->checkPermissionTo($ability));
            }

            if ($user->hasRole('super_admin')) {
                return true;
            }

            return $user->checkPermissionTo($ability) ?: null;
        });
    }
}