<?php
namespace App\Http\Middleware;

use App\Support\ApiResponse;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

final class RequirePayoutStepUp
{
    public function handle(Request $request, Closure $next): Response
    {
        $verifiedAt = (int) $request->session()->get('payout_step_up_verified_at', 0);
        $ttl = (int) config('gateway.security.payout_step_up_ttl_seconds', 300);
        if ($verifiedAt === 0 || (time() - $verifiedAt) > $ttl) {
            return ApiResponse::error('STEP_UP_REQUIRED', 'Recent two-factor verification is required for payout actions.', 403);
        }
        return $next($request);
    }
}
