<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class WhitelistVipResellerIp
{
    /**
     * VIP Reseller IP addresses
     */
    private $allowedIps = [
        '178.248.73.218',  // VIP Reseller webhook IP
        '103.xxx.xxx.xxx', // Tambah IP lain kalau ada
    ];

    public function handle(Request $request, Closure $next)
    {
        // Get real IP (consider proxies/cloudflare)
        $ip = $request->ip();
        
        // Allow if from allowed IPs
        if (in_array($ip, $this->allowedIps)) {
            return $next($request);
        }

        // Deny
        return response()->json([
            'success' => false,
            'message' => 'Unauthorized IP: ' . $ip
        ], 403);
    }
}