<?php

declare(strict_types=1);

namespace App\Module\Core\Infrastructure\Security;

use App\Module\Core\Domain\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
use Symfony\Component\Security\Core\User\UserCheckerInterface;
use Symfony\Component\Security\Core\User\UserInterface;

/**
 * Rejects authentication for archived (soft-deleted) users, both at password
 * login and on every JWT-authenticated request, so an archived account is
 * effectively locked out while its data is preserved.
 */
final class ArchivedUserChecker implements UserCheckerInterface
{
    public function checkPreAuth(UserInterface $user, ?TokenInterface $token = null): void
    {
        if ($user instanceof User && $user->isArchived()) {
            throw new CustomUserMessageAccountStatusException('This account has been archived.');
        }
    }

    public function checkPostAuth(UserInterface $user, ?TokenInterface $token = null): void {}
}