<?php

namespace App\Http\Middleware;

use App\Support\ApiTokenLifetime;
use Closure;

class EnforceApiTokenLifetimeMiddleware
{
    /**
     * Enforce application session lifetime for Passport personal access tokens.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string  $portal  voter|admin
     * @return mixed
     */
    public function handle($request, Closure $next, $portal = 'voter')
    {
        $user = $request->user();

        if (! $user || ! ApiTokenLifetime::isExpired($user, $portal)) {
            return $next($request);
        }

        try {
            if (method_exists($user, 'token') && $user->token()) {
                $user->token()->revoke();
            }
        } catch (\Throwable $e) {
            // Continue with 401 even if revoke fails.
        }

        return response()->json([
            'status' => 'failed',
            'message' => 'Sesi tamat. Sila log masuk semula.',
        ], 401);
    }
}