import {
  ForbiddenException,
  Inject,
  Injectable,
  type CanActivate,
  type ExecutionContext,
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';

import type { PermissionCode } from '@lehuo/contracts';

import { REQUIRED_PERMISSIONS_KEY } from '../common/decorators/require-permissions.decorator';
import type { RequestContext } from '../common/request-context';

@Injectable()
export class PermissionGuard implements CanActivate {
  constructor(@Inject(Reflector) private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const required = this.reflector.getAllAndOverride<PermissionCode[]>(REQUIRED_PERMISSIONS_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);
    if (!required?.length) return true;
    const request = context.switchToHttp().getRequest<RequestContext>();
    if (
      !request.auth ||
      required.some((permission) => !request.auth?.permissions.includes(permission))
    ) {
      throw new ForbiddenException();
    }
    return true;
  }
}