<?php

declare(strict_types=1);

namespace App\Middleware;

use App\Core\ErrorHandler;
use App\Core\Logger;
use App\Core\MiddlewareInterface;
use App\Core\Request;

/**
 * DeveloperMiddleware — Developer Console Access Guard
 *
 * Validates that `DEVELOPER_MODE` is enabled in application configuration.
 * When DEVELOPER_MODE=false:
 *   - Access to /app/developer/* routes is blocked.
 *   - Renders 403 Forbidden / 404 Not Found via ErrorHandler.
 *   - Logs security warning.
 *
 * @package Inveetaire
 * @ref     DX003
 */
class DeveloperMiddleware implements MiddlewareInterface
{
    public function handle(Request $request, callable $next): void
    {
        $enabled = (bool) config('app.developer_mode', true);

        if (!$enabled) {
            Logger::warning('Access denied to Developer Console — DEVELOPER_MODE is disabled', [
                'path' => $request->getPath(),
                'ip'   => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
            ]);

            ErrorHandler::renderForbidden();
            return;
        }

        $next($request);
    }
}
