<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use Laravel\Sanctum\PersonalAccessToken;
use App\Models\Cafe; // Update with your actual user model

class TokenAuthMiddleware
{
    public function handle(Request $request, Closure $next): Response
    {
        // Get the token from custom header `x-access-token`
        $token = $request->header('x-access-token');

        if (empty($token)) {
            return response()->json(['error' => 'x-access-token header is missing or empty'], 401);
        }

        // Validate the token using Sanctum
        $accessToken = PersonalAccessToken::findToken($token);

        if (!$accessToken) {
            return response()->json(['error' => 'Invalid or expired token'], 401);
        }

        // Retrieve the user associated with the token
        $user = Cafe::find($accessToken->tokenable_id);

        if (!$user) {
            return response()->json(['error' => 'User not found or inactive'], 401);
        }

        // Inject user into the request for later use
        $request->merge(['user' => $user]);

        return $next($request);
    }
}