<?php

declare(strict_types=1);

namespace App\Policies;

use App\Contracts\OwnedByUser;
use App\Enums\UserRole;
use App\Models\User;
use Illuminate\Auth\Access\Response;

/**
 * The general account profile.
 *
 * Reading it is more sensitive than reading a seller profile: it carries
 * address, tax identifier and contact details. Support gets no blanket read for
 * that reason -- handling a dispute does not require someone's home address.
 *
 * @extends OwnershipPolicy
 */
final class ProfilePolicy extends OwnershipPolicy
{
    public function view(User $user, OwnedByUser $resource): Response
    {
        if ($this->owns($user, $resource)) {
            return Response::allow();
        }

        // Deliberately narrower than the base policy: full contact and billing
        // details are admin-only, not support-readable.
        return $user->hasAtLeastRole(UserRole::Admin)
            ? Response::allow()
            : $this->notFound();
    }
}
