<?php

declare(strict_types=1);

namespace Apexl\Io\User\Hooks;

use Apexl\Io\Interfaces\AbstractHook;
use Apexl\Io\System\Collections\MiddlewareCollectionCollection;
use Apexl\Io\System\Services\MiddlewareCollector;
use Apexl\Io\User\Middleware\SessionMiddleware;
use Apexl\Io\User\Middleware\TwoFactorMiddleware;

final readonly class AddMiddleware implements AbstractHook
{
    public function hooks(): array
    {
        return [MiddlewareCollector::HOOK__COLLECT];
    }

    public function __invoke(MiddlewareCollectionCollection $weightedMiddleware): MiddlewareCollectionCollection
    {
        // Order matters: these two share the MIDDLE weight group and are added
        // consecutively, so Session -> TwoFactor is preserved. TwoFactorMiddleware
        // needs the `authenticated` attribute + loaded session that SessionMiddleware
        // sets. When 2FA mode is off, it short-circuits on its first line.
        //
        // Permissions are no longer here. They ride on the routes that have them, as
        // RoutePermissionMiddleware, and per-route middleware runs inside app-level
        // middleware — so 2FA still gates before any route grants access.
        $weightedMiddleware->add(SessionMiddleware::class);
        $weightedMiddleware->add(TwoFactorMiddleware::class);

        return $weightedMiddleware;
    }
}
