<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class ImportApiMiddleware
{
    public function handle(Request $request, Closure $next)
    {
        $apiKey = config('app.import_api_key');
        $provided = $request->header('X-Import-Key') ?? $request->query('api_key');

        if (!$apiKey || $provided !== $apiKey) {
            return response()->json(['error' => 'Unauthorized'], 401);
        }

        return $next($request);
    }
}