<?php

namespace App\Http\Requests\Admin;

use Illuminate\Foundation\Http\FormRequest;

class DryRunWorkflowRequest extends FormRequest
{
    /**
     * Allow-list of entity types valid for dry-run / continue-job lookups.
     * Prevents arbitrary class instantiation via user input (PRC-26 C7).
     */
    public const ALLOWED_ENTITY_TYPES = [
        \App\Models\Client::class,
        \App\Models\Invoice::class,
        \App\Models\ClientProduct::class,
        \App\Models\ClientDomain::class,
        \App\Models\Ticket::class,
        \App\Models\Order::class,
    ];

    public function authorize(): bool
    {
        return $this->user('admin')?->can('manage workflows') ?? false;
    }

    public function rules(): array
    {
        return [
            'entity_type' => ['nullable', 'string', 'in:'.implode(',', self::ALLOWED_ENTITY_TYPES)],
            'entity_id' => ['nullable', 'integer'],
        ];
    }
}
