<?php

namespace App\Http\Middleware;

use App\Enums\ApiError;
use App\Exceptions\Api\v2\ApiErrorException;
use App\Lib\Helper;
use Closure;
use Illuminate\Http\Request;

/**
 * Check Http Header Timestamp with request timestamp
 * to prevent replay attacks
 * https://restfulapi.net/security-essentials/
 */
class ApiCheckTimeStamps
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        if (Helper::isRequestForApiV2($request)) {
            $badRequest = new ApiErrorException(ApiError::wrongTimeStamp(), 400);
            if (!$request->hasHeader('X-API-TIMESTAMP') or !is_numeric($request->header('X-API-TIMESTAMP'))) {
                throw $badRequest;
            }
            if (!$request->timestamp or !is_numeric($request->timestamp)) {
                throw $badRequest;
            }
            $diff    = intval($request->timestamp) - intval($request->header('X-API-TIMESTAMP'));
            $maxDiff = 120;
            if (abs($diff) > $maxDiff) {
                throw $badRequest;
            }
        }
        return  $next($request);
    }
}