<?php

declare(strict_types=1);

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

/**
 * Admin gate: single-operator password from .env (bcrypt), session
 * flag, CSRF-protected login. Deliberately simple — swap for SSO or a
 * users table later without touching routes (same filter alias).
 */
final class AdminAuth implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        // The login/logout pair is exempted in Filters::$filters config.
        $uri = uri_string();
        if ($uri === 'admin/login' || $uri === 'admin/auth/attempt') {
            return null;
        }

        if (! session()->get('tv_admin_ok')) {
            return redirect()->to('/admin/login');
        }

        return null;
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        return null;
    }
}