<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureUserBelongsToCompany
{
    /**
     * Blocks Super Admins (company_id = null) from a route entirely. Used
     * on the bookings/customers/drivers surface, where per-company records
     * — including customer PII — must never be visible cross-tenant. A
     * Super Admin's view into that data is the aggregate counts on the
     * Platform Overview page, not individual records.
     */
    public function handle(Request $request, Closure $next): Response
    {
        abort_if($request->user()?->isSuperAdmin(), 403, 'Super Admins do not have access to individual company records. See Platform Overview for company-wise stats.');

        return $next($request);
    }
}
