<?php

namespace App\Http\Controllers\Api\V1;

use App\Http\Controllers\Controller;
use App\Models\User;
use App\Models\WhitelistApplication;
use Illuminate\Http\JsonResponse;

class WhitelistCheckController extends Controller
{
    /**
     * Called from Lua on player connect. `$license` is matched against the
     * UCP account linked via /linkucp (User::fivem_license) so the
     * whitelist decision follows the Discord-verified account rather than
     * a raw game license the player could otherwise spoof by re-linking.
     */
    public function __invoke(string $license): JsonResponse
    {
        $user = User::query()->where('fivem_license', $license)->first();

        if (! $user) {
            return response()->json(['whitelisted' => false, 'reason' => 'Account not linked. Use /linkucp in-game first.']);
        }

        $approved = WhitelistApplication::query()
            ->where('user_id', $user->id)
            ->where('status', 'approved')
            ->exists();

        return response()->json(['whitelisted' => $approved]);
    }
}
