<?php

namespace App\Http\Middleware;

use App\Support\Demo;
use Closure;
use Illuminate\Http\Request;

class DemoMode
{
    /**
     * Refuse the writes config/demo.php names, while demo mode is on.
     *
     * Registered in the web and api groups, which run SubstituteBindings
     * first, so the rules can read the route bound models. Inertia pushes its
     * own global middleware to turn the 302 below into a 303 for PUT, PATCH
     * and DELETE, which is what stops the browser repeating the verb.
     *
     * @param  Request  $request
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $reason = Demo::blocks($request);

        if ($reason === null) {
            return $next($request);
        }

        // The API answers with a status the client can branch on. The web UI
        // gets a flash message, which HandleInertiaRequests turns into the red
        // toast both layouts already watch for. An abort() there would render
        // the stock error page, which an Inertia visit cannot parse.
        return $request->expectsJson()
            ? abort(403, $reason)
            : back()->with('error', $reason);
    }
}