<?php

declare(strict_types=1);

namespace App\Policies;

use App\Models\User;

class MediaPolicy extends ResourcePolicy
{
    protected function resource(): string
    {
        return 'media';
    }

    /**
     * Files arrive by being uploaded on a record, not by being created here.
     */
    public function create(User $user): bool
    {
        return false;
    }

    /**
     * Uploading through the API, which has no form to attach a file to.
     *
     * Still true to the rule above in spirit: through the API the one record
     * that holds an image is a page, so whoever may write pages may upload the
     * image for one — and nobody else, whatever their `media.*` permissions,
     * which only ever described looking after files that already exist.
     */
    public function upload(User $user): bool
    {
        return $user->can('pages.create') || $user->can('pages.update');
    }

    /**
     * A file something still points at cannot be deleted from here: doing so
     * would leave a broken image on the public site, which is precisely what
     * the health check exists to complain about.
     */
    public function delete(User $user, $model): bool
    {
        return parent::delete($user, $model) && ! $model->isReferenced();
    }
}