<?php

namespace App\Http\Controllers\Api\Admin;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Symfony\Component\HttpFoundation\StreamedResponse;

class PrivateDocController extends Controller
{
    /**
     * Serve a private document — vendor_docs or delivery_docs disk.
     * Route is protected by signed middleware: admins generate a signed URL,
     * the document streams back if the signature is valid.
     */
    public function serve(Request $request, string $disk, string $path): StreamedResponse
    {
        abort_unless(in_array($disk, ['vendor_docs', 'delivery_docs', 'invoices'], true), 404);
        abort_unless(Storage::disk($disk)->exists($path), 404);

        return Storage::disk($disk)->response($path);
    }
}
