import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { AuthService } from './auth.service.js';
import { PERMISSIONS_KEY } from './decorators.js';

@Injectable()
export class PermissionsGuard implements CanActivate {
  constructor(
    private readonly auth: AuthService,
    private readonly reflector: Reflector,
  ) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const required = this.reflector.getAllAndOverride<string[]>(PERMISSIONS_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);
    if (!required || required.length === 0) return true;

    const request = context.switchToHttp().getRequest();
    const user = request.user as { userId: string; tenantCode: string } | undefined;
    if (!user) throw new ForbiddenException('无权限');

    const { super: isSuper, permissions } = await this.auth.getPermissionSet(user.tenantCode, user.userId);
    if (isSuper) return true;
    if (required.every((code) => permissions.includes(code))) return true;
    throw new ForbiddenException('无权限');
  }
}