<?php

declare(strict_types=1);

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Guards the endpoints the frontend writes to on its own behalf.
 *
 * Everything else under /api/public is either read-only or written by a
 * visitor filling in a form. This is neither: it is one server talking to
 * another, so it can hold a secret, and it should — an open write endpoint is
 * an invitation to fill a table with someone else's idea of a URL.
 *
 * The secret travels in a header rather than the query string so it stays out
 * of access logs. An unset token disables the endpoint rather than opening it,
 * the same rule the preview secret follows.
 */
class VerifyIngestToken
{
    public function handle(Request $request, Closure $next): Response
    {
        $secret = (string) config('site.telemetry.token');

        if (blank($secret)) {
            return $this->refuse(__('site.telemetry.disabled'));
        }

        $presented = $request->header('X-Ingest-Token');

        if (! is_string($presented) || ! hash_equals($secret, $presented)) {
            return $this->refuse(__('site.telemetry.forbidden'));
        }

        return $next($request);
    }

    protected function refuse(string $message): Response
    {
        return response()->json(['message' => $message], Response::HTTP_FORBIDDEN)
            ->header('Cache-Control', 'no-store, private');
    }
}