namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class PreventBruteForceOnAsyncRoute
{
    /**
     * Methods that are restricted from being invoked via the async route.
     */
    protected array $restrictedMethods = [
        'validate',
        'handle',
        '__invoke',
        'validateWith',
        'validateWithBag',
        'callAction',
    ];

    /**
     * Handle an incoming request.
     */
    public function handle(Request $request, Closure $next): Response
    {
        // Retrieve the current route from the request.
        /** @var \Illuminate\Routing\Route|null $route */
        $route = $request->route();

        // Allow requests to routes other than "platform.async".
        if ($route?->getName() !== 'platform.async') {
            return $next($request);
        }

        // Block requests attempting to invoke any of the restricted methods.
        if (in_array($route->parameter('method'), $this->restrictedMethods)) {
            abort(503, sprintf(
                'Access to the "%s" method is restricted.',
                $route->parameter('method')
            ));
        }

        // Continue request processing for other cases.
        return $next($request);
    }
}