<?php

namespace App\Http\Middleware;
use Illuminate\Support\Facades\Auth;
use Closure;

class RoleAccess
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string  ...$roles
     * @return mixed
     */
    public function handle($request, Closure $next, ...$roles)
    {
        if (!Auth::check()) {
            return redirect('/login');
        }

        $user = Auth::user();
        $userRole = $user->roles;
        $userRoleHarian = $user->role_harian ?? null;

        // Check each allowed role
        foreach ($roles as $role) {
            switch ($role) {
                case 'teller':
                    if ($userRoleHarian == 'teller' || $userRole == 'teller') {
                        return $next($request);
                    }
                    break;
                    
                case 'khazanah':
                    if ($userRole == 'pc' || $userRole == 'ppc') {
                        return $next($request);
                    }
                    break;
                    
                case 'admin':
                    if ($userRole == 'admin') {
                        return $next($request);
                    }
                    break;
                    
                case 'penilai':
                    if ($userRole == 'penilai') {
                        return $next($request);
                    }
                    break;
                    
                case 'operasi':
                    if ($userRole == 'operasi') {
                        return $next($request);
                    }
                    break;
                    
                case 'audit':
                    if ($userRole == 'audit') {
                        return $next($request);
                    }
                    break;
            }
        }

        // If no roles matched, deny access
        abort(403, 'Access denied. Required roles: ' . implode(', ', $roles));
    }
}