<?php

namespace App\Http\Requests\Api;

use App\Libs\Security\XSSCleanFilter;
use Illuminate\Foundation\Http\FormRequest;
use App\Libs\Support\Sanitizer\Traits\SanitizesInput;

class UserDelete extends FormRequest
{
    use SanitizesInput;
    /**
     * Determine if the user is authorized to make this request.
     *
     * GDPR Right to be Forgotten: Users can delete their own account
     * to exercise their data protection rights under EU GDPR Article 17.
     *
     * @return bool
     */
    public function authorize()
    {
        $currentUser = $this->user();

        // Must be authenticated
        if (!$currentUser) {
            return false;
        }

        // Get the user ID from the route
        $userIdToDelete = (int) $this->route('id');

        // GDPR Self-deletion: User can only delete their own account
        if ($currentUser->id !== $userIdToDelete) {
            return false;
        }

        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'id' => 'bail|required|integer|min:1|exists:users,id',
        ];
    }

    /**
     * Get the error messages for the defined validation rules.
     *
     * @return array
     */
    public function messages()
    {
        return [
            'id.exists' => 'The user account you are trying to delete does not exist.',
        ];
    }

    public function filters()
    {
        return [
            'id' => "trim|strip_tags|xss_clean",
        ];
    }

    public function all($keys = null)
    {
        $data = parent::all();
        if ($this->route()->hasParameters()) {
            $parameterName = $this->route()->parameterNames()[0];
            $data['id'] = $this->route()->parameter($parameterName);
        }
        return $data;
    }

    public function customFilters()
    {
        return ['xss_clean' => XSSCleanFilter::class];
    }
}