📄 VendorPlanGate.php

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

/**
 * VendorPlanGate Middleware
 *
 * Checks whether the authenticated vendor's active plan allows access to the
 * requested feature. Feature names are passed as middleware parameters:
 *   e.g. Route::middleware('vendor.plan:bulk_upload')
 *
 * If no plan feature is specified, it simply verifies the vendor has an active plan.
 */
class VendorPlanGate
{
    public function handle(Request $request, Closure $next, string $feature = ''): Response
    {
        $user = $request->user();

        if (! $user || ! $user->vendor) {
            return response()->json(['message' => 'Vendor account required.'], 403);
        }

        $vendor = $user->vendor;

        // If vendor has no active plan, deny access to gated features
        if ($feature && ! $vendor->plan?->hasFeature($feature)) {
            return response()->json([
                'message' => "Your current plan does not include the '{$feature}' feature. Please upgrade.",
                'upgrade_url' => route('vendor.plans.index'),
            ], 403);
        }

        return $next($request);
    }
}