<?php

declare(strict_types=1);

namespace Core\Auth;

use Core\Request;
use Core\Response;

class AuthMiddleware
{
    /**
     * Check authentication (and optionally a required permission).
     * Returns a redirect/error Response when the check fails, null when it passes.
     */
    public function handle(Request $request, ?string $permission = null): ?Response
    {
        if (!auth()->check()) {
            return Response::redirect('/login');
        }

        if ($permission !== null && !auth()->can($permission)) {
            return Response::notFound('You do not have permission to access this page.');
        }

        return null;
    }
}