<?php

/**
 * Invoice Ninja (https://invoiceninja.com).
 *
 * @link https://github.com/invoiceninja/invoiceninja source repository
 *
 * @copyright Copyright (c) 2026. Invoice Ninja LLC (https://invoiceninja.com)
 *
 * @license https://www.elastic.co/licensing/elastic-license
 */

namespace App\Http\Requests\ClientPortal\Documents;

use App\Models\Document;
use App\Models\ClientContact;
use App\Utils\Traits\MakesHash;
use Illuminate\Foundation\Http\FormRequest;

class DownloadMultipleDocumentsRequest extends FormRequest
{
    use MakesHash;

    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize(): bool
    {
        /** @var \App\Models\ClientContact $contact */
        $contact = auth()->guard('contact')->user();

        $document_ids = $this->transformKeys($this->file_hash ?? []);

        /** @var \Illuminate\Database\Eloquent\Collection<int, \App\Models\Document> $documents */
        $documents = Document::query()
            ->with('documentable')
            ->whereIn('id', $document_ids)
            ->where('company_id', $contact->company_id)
            ->get();

        // Fail if any requested document doesn't exist in this company
        if ($documents->count() !== count($document_ids)) {
            return false;
        }

        foreach ($documents as $document) {
            if (! $this->contactCanAccessDocument($contact, $document)) {
                return false;
            }
        }

        return true;
    }

    private function contactCanAccessDocument(ClientContact $contact, Document $document): bool
    {
        if (! $document->is_public) {
            return false;
        }

        // Public company-level documents
        if ($document->documentable_type == 'App\Models\Company') {
            return $document->company_id == $contact->company_id;
        }

        // Documents attached directly to a client
        if ($document->documentable_type == 'App\Models\Client') {
            return ClientContact::where('client_id', $document->documentable_id)
                                ->where('email', $contact->email)
                                ->where('company_id', $contact->company_id)
                                ->exists();
        }

        $entity = $document->documentable;

        if ($entity === null || ! isset($entity->client_id)) {
            return false;
        }

        // Public documents on entities (Invoice, Quote, etc.) belonging to a client
        // this contact has access to
        return ClientContact::where('client_id', $entity->client_id)
                            ->where('email', $contact->email)
                            ->where('company_id', $contact->company_id)
                            ->exists();
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules(): array
    {
        return [
            'file_hash' => ['required', 'array'],
        ];
    }
}
