import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from "@nestjs/common";
import type { Request } from "express";
import { SUPER_ADMIN_ROLE } from "./permissions.js";

/**
 * Role definition and the permission matrix itself (role_permissions) are
 * the root of the whole authorization system — deliberately kept
 * super_admin-only and hardcoded, exactly like the legacy's
 * `requireSuperAdmin` (eden.md §8), rather than generalized to the
 * resource/action/scope model. Generalizing config-of-the-authorization-
 * system-itself would let a misconfigured permission accidentally grant
 * permission-configuration rights — not worth the flexibility.
 */
@Injectable()
export class SuperAdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<Request>();
    if (request.edenUser?.roleKey !== SUPER_ADMIN_ROLE) {
      throw new ForbiddenException("Exclusivo do super_admin");
    }
    return true;
  }
}