import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { Roles } from './roles.decorator';

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    // 1. Retrieve the required roles from either the route handler or the controller class
    const requiredRoles = this.reflector.getAllAndOverride<string[]>(Roles, [
      context.getHandler(),
      context.getClass(),
    ]);

    // 2. If no roles are specified, allow access by default
    if (!requiredRoles || requiredRoles.length === 0) {
      return true;
    }

    // 3. Retrieve user from the request context (populated by AuthGuard)
    const { user } = context.switchToHttp().getRequest();

    // 4. Verify user exists and has one of the allowed roles
    if (!user || !user.role || !requiredRoles.includes(user.role)) {
      throw new ForbiddenException('Access denied: You do not have the required permissions.');
    }

    return true;
  }
}