<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * Gate for the /releases admin tooling (sprint release email generation).
 * Simple shared-password session gate — the rest of The Manifest is public;
 * there is no separate "dev" documentation area anymore.
 */
class ManifestDevAuth
{
    public function handle(Request $request, Closure $next): Response
    {
        if (! config('services.manifest.dev_password')) {
            abort(503, 'MANIFEST_DEV_PASSWORD is not configured.');
        }

        if (! $request->session()->get('manifest_dev_ok', false)) {
            return redirect()->route('manifest.dev.login');
        }

        return $next($request);
    }
}
