<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class ClientAccessTokenCheck
{
    /**
     * Verify the `x-access-token` header contains an AES-256-CBC ciphertext
     * (base64(iv . ciphertext)) of the shared secret, encrypted with the
     * openssl key configured in services.client_api.key. Blocks callers
     * that don't hold the shared key (external scraping/direct API calls).
     */
    public function handle(Request $request, Closure $next)
    {
        $token = $request->header('x-access-token', '');
        $key = config('services.client_api.key');

        if (!$key || !$this->isValid($token, $key)) {
            return response()->json([
                'error' => true,
                'message' => 'Invalid access token',
                'code' => 403,
            ], 403);
        }

        return $next($request);
    }

    private function isValid(string $token, string $key): bool
    {
        $raw = base64_decode($token, true);
        if ($raw === false || strlen($raw) <= 16) {
            return false;
        }

        $iv = substr($raw, 0, 16);
        $ciphertext = substr($raw, 16);

        $plaintext = openssl_decrypt($ciphertext, 'aes-256-cbc', hex2bin($key), OPENSSL_RAW_DATA, $iv);

        if ($plaintext === false) {
            return false;
        }

        return hash_equals(config('services.client_api.secret'), $plaintext);
    }
}