import {
  CanActivate,
  ExecutionContext,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import type { Request } from 'express';
import { ApiKeysService } from './api-keys.service';

export interface ApiKeyContext {
  empresa_id: string;
  api_key_id: string;
  scopes: string[];
}

declare module 'express' {
  interface Request {
    carteraApiContext?: ApiKeyContext;
  }
}

@Injectable()
export class ApiKeyGuard implements CanActivate {
  constructor(private readonly service: ApiKeysService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const req = context.switchToHttp().getRequest<Request>();
    const key = (req.headers['x-api-key'] as string) ?? '';
    if (!key) {
      throw new UnauthorizedException(
        'Falta header X-Api-Key. Generá una en Cartera Inteligente → API → Claves.',
      );
    }
    const ctx = await this.service.validar(key);
    if (!ctx) {
      throw new UnauthorizedException('API key inválida, expirada o revocada.');
    }
    req.carteraApiContext = ctx;
    return true;
  }
}

export function getApiContext(req: Request): ApiKeyContext {
  if (!req.carteraApiContext) {
    throw new UnauthorizedException('Sin contexto de API key.');
  }
  return req.carteraApiContext;
}