import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from "@nestjs/common";
import type { Request } from "express";
import { AdminAuthService } from "./admin-auth.service";

declare module "express" {
  interface Request {
    adminUser?: {
      id: string;
      email: string;
      role: string;
    };
  }
}

@Injectable()
export class AdminUserGuard implements CanActivate {
  constructor(private readonly service: AdminAuthService) {}

  canActivate(context: ExecutionContext): boolean {
    const req = context.switchToHttp().getRequest<Request>();
    const auth = req.header("authorization");
    if (!auth || !auth.startsWith("Bearer ")) {
      throw new UnauthorizedException("Missing admin token");
    }
    const claims = this.service.verifyAccessToken(auth.slice(7).trim());
    req.adminUser = { id: claims.sub, email: claims.email, role: claims.role };
    // Compatibilidad con el AuthContext existente — controladores que dependen
    // de `req.auth.kind === "admin"` siguen funcionando.
    req.auth = { kind: "admin" };
    return true;
  }
}