<?php

namespace Modules\PortalApi\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

/**
 * Temporary auth stub for the pet-owner PWA API.
 *
 * Accepts:
 *   Authorization: Bearer demo-<anything>
 *
 * Replace this with a real Sanctum/OAuth check once the auth backend
 * (OTP / magic link / password) is wired. The PWA already stores its
 * dev token under that 'demo-*' prefix, so production tokens can use
 * any other prefix and this middleware can stop accepting demo-*.
 */
class DemoAuth
{
    public function handle(Request $request, Closure $next)
    {
        $token = $request->bearerToken() ?? '';
        if ($token === '' || ! str_starts_with($token, 'demo-')) {
            return response()->json(['message' => 'Unauthenticated'], 401);
        }
        return $next($request);
    }
}
