import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
import { Request } from 'express';
import { Kysely } from 'kysely';
import { DB } from 'src/database/database.type';
import { AuthHelper } from '../../utils/auth.helpers';

export const DASHBOARD_ADMIN_TOKEN_TYPE = 'dashboard_admin';

@Injectable()
export class AdminAuthGuard implements CanActivate {
  constructor(
    private readonly authHelper: AuthHelper,
    private readonly db: Kysely<DB>,
  ) {}

  async canActivate(ctx: ExecutionContext): Promise<boolean> {
    const request = ctx.switchToHttp().getRequest();
    const token = this.extractTokenFromHeader(request);
    if (!token) throw new UnauthorizedException();

    const payload = this.authHelper.verifyToken(token);
    if (!payload || payload.type !== DASHBOARD_ADMIN_TOKEN_TYPE) {
      throw new UnauthorizedException();
    }

    const admin = await this.db
      .selectFrom('admins')
      .select(['id', 'email', 'display_name', 'role', 'is_active'])
      .where('id', '=', payload.id)
      .where('deleted_at', 'is', null)
      .executeTakeFirst();

    if (!admin || !admin.is_active) throw new UnauthorizedException();

    request['admin'] = admin;
    return true;
  }

  private extractTokenFromHeader(request: Request): string | undefined {
    const [type, token] = request.headers.authorization?.split(' ') ?? [];
    return type === 'Bearer' ? token : undefined;
  }
}