import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import { PermissionResolverService } from '../../auth/permissions/permission-resolver.service';
import type { AuthenticatedUser } from '../../auth/types/authenticated-user';

interface RequestWithUser {
  user?: AuthenticatedUser;
}

/**
 * Voice notes end in an inspection, so every voice endpoint also needs
 * inspections:create (spec 3) on top of voice-captures:use. @RequirePermission
 * is "any of", so the second right is its own guard. A request without a
 * signed-in person (an API key) never passes.
 */
@Injectable()
export class InspectionCreateGuard implements CanActivate {
  constructor(private readonly permissionResolver: PermissionResolverService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const user = context.switchToHttp().getRequest<RequestWithUser>().user;
    if (!user) {
      return false;
    }
    return this.permissionResolver.hasAny(user.id, ['inspections:create']);
  }
}