import {
  CanActivate,
  ExecutionContext,
  ForbiddenException,
  Injectable,
} from '@nestjs/common';
import type { AppUser } from './auth.types.js';

/**
 * Customers share the session cookie with admins, so signing in is not
 * enough for /admin routes. Applied with @UseGuards, it runs after the
 * global AuthenticationGuard has set `request.user`.
 */
@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const user = context.switchToHttp().getRequest<{ user?: AppUser | null }>().user;
    if (user?.role !== 'ADMIN') {
      throw new ForbiddenException('Only store administrators can do this.');
    }
    return true;
  }
}