<?php

declare(strict_types=1);

namespace App\Http\Controllers\Api\PublicApi\V1;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;

/**
 * Shared behaviour for the public, unauthenticated endpoints.
 *
 * These endpoints serve the public frontend. They are deliberately readable by
 * anyone: everything they return is already published on the public website,
 * so requiring a token would add ceremony without adding protection. What is
 * *not* published is gated by the preview secret instead.
 */
abstract class PublicController extends Controller
{
    /**
     * Whether this request may see unpublished content, as decided by
     * App\Http\Middleware\AllowPreview.
     */
    protected function isPreview(Request $request): bool
    {
        return (bool) $request->attributes->get('preview', false);
    }

    /**
     * Page size, capped so a public caller cannot ask for everything at once.
     */
    protected function perPage(Request $request, int $default = 20, int $max = 100): int
    {
        return min(max($request->integer('per_page', $default), 1), $max);
    }
}