<?php

namespace App\Http\Middleware;

use App\Models\ApiKey;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class AuthenticateApiKey
{
    public function handle(Request $request, Closure $next): Response
    {
        $key = $request->bearerToken() ?? $request->get('api_key');

        if (! $key) {
            return response()->json(['error' => 'Invalid API key'], 401);
        }

        $apiKey = ApiKey::where('key', $key)->with('user')->first();

        if (! $apiKey) {
            return response()->json(['error' => 'Invalid API key'], 401);
        }

        auth()->login($apiKey->user);
        $apiKey->update(['last_used_at' => now()]);

        return $next($request);
    }
}