<?php

declare(strict_types=1);

namespace App\Http\Requests\Api\V1\Concerns;

use Illuminate\Validation\Validator;

/**
 * Publishing is a permission of its own, as in the panel — where these fields
 * are disabled for whoever lacks it. Here they are refused, so someone who may
 * write a record still cannot put it on the site, or take it off, alone.
 */
trait GuardsPublication
{
    /**
     * @param  array<int, string>  $fields
     */
    protected function guardPublication(Validator $validator, string $permission, array $fields): void
    {
        $validator->after(function (Validator $validator) use ($permission, $fields): void {
            if ($this->user()?->can($permission)) {
                return;
            }

            foreach ($fields as $field) {
                if ($this->has($field)) {
                    $validator->errors()->add($field, __('rules.publication.forbidden'));
                }
            }
        });
    }
}