<?php

namespace App\Http\Middleware;

use App\Models\PartnerCredential;
use Closure;

class ValidatePartnerAuth
{
    /**
     * Authenticate service partners via the X-Api-Key header.
     * The matched PartnerCredential is attached to the request attributes as 'partner'.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $key = $request->header('X-Api-Key');

        $partner = $key ? PartnerCredential::findByApiKey($key) : null;

        if (!$partner) {
            return response()->json([
                'error' => 'UNAUTHORIZED',
                'message' => 'Missing or invalid X-Api-Key header',
            ], 401);
        }

        $partner->forceFill(['last_used_at' => date('Y-m-d H:i:s')])->save();

        $request->attributes->set('partner', $partner);

        return $next($request);
    }
}