<?php

declare(strict_types=1);

namespace BotGuard\Middleware;

use BotGuard\Core\Auth;
use BotGuard\Core\Exceptions\HttpException;
use BotGuard\Core\Request;
use BotGuard\Core\Response;
use Closure;

/**
 * Requires the authenticated user to hold the "admin" role.
 *
 * Registered under the alias "admin". Assumes the "auth" middleware ran first.
 */
final class AdminMiddleware implements MiddlewareInterface
{
    public function __construct(private Auth $auth)
    {
    }

    public function handle(Request $request, Closure $next): Response
    {
        if (! $this->auth->isAdmin()) {
            throw new HttpException(403, 'Administrator access required.');
        }

        return $next($request);
    }
}
