<?php

namespace app\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;

class ApiKeyAuth implements MiddlewareInterface
{
    public function process(Request $request, callable $handler): Response
    {
        $apiKey = $request->header('Fdesk-Api-Key', '');
        $validKey = getenv('PUBLIC_API_KEY');

        if ($validKey === false || $apiKey === '' || !hash_equals($validKey, $apiKey)) {
            $body = [
                'status'  => 'fail',
                'code'    => 401,
                'message' => '无效的 API Key',
                'data'    => [],
            ];
            return response(json_encode($body, JSON_UNESCAPED_UNICODE), 401, ['Content-Type' => 'application/json']);
        }

        return $handler($request);
    }
}