<?php

namespace App\Http\Middleware;

use Illuminate\Http\Request;
use Illuminate\Support\Carbon;

/**
 * Check Http Header Timestamp with request timestamp
 * to prevent replay attacks
 * https://restfulapi.net/security-essentials/
 */
class ApiCheckTimeStamps
{
    /**
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure                 $next
     * @return mixed
     * @throws \Symfony\Component\HttpKernel\Exception\HttpException If timestamp has an incorrect
     *                                                               format or is timed out.
     */
    public function handle(Request $request, \Closure $next)
    {
        if (
            !\is_string($request->input('timestamp')) or
            !Carbon::hasFormat($request->input('timestamp'), 'Y-m-d H:i:s')
        ) {
            abort(401, 'Timestamp isn\'t correctly formatted');
        }
        if (
            Carbon::parse($request->input('timestamp'), 'utc')
            ->isBefore(Carbon::now('UTC')->subSeconds(config('api.timestampTimeout', 10)))
        ) {
            abort(401, 'Timestamp is too old');
        }
        return $next($request);
    }
}