# Middleware System

The middleware layer is responsible for intercepting requests and determining access:

### Access Control Flow

```php
/**
 * Handle an incoming request.
 */
public function handle(Request $request, Closure $next): Response
{
    $canAccess = Curtain::canAccessPath($request);

    if ($canAccess) {
        return $next($request);
    }

    return Curtain::render();
}
```

```php
/**
 * Check if a request should be allowed through maintenance mode.
 *
 * @param  Request  $request  The HTTP request
 * @return bool True if request should be allowed
 */
public function canAccessPath(Request $request): bool
{
    if (! $this->isDownForMaintenance()) {
        return true;
    }

    if ($this->shouldPassThroughPath($request->path())) {
        return true;
    }

    if ($this->isAllowedIp($request->ip())) {
        return true;
    }

    return $this->hasValidBypassToken($request);
}
```

### Access Control Hierarchy

* IP Whitelist Check
* Excluded Paths Check
* Bypass Token Check
* Default: Show maintenance page
