import {
  CanActivate,
  ExecutionContext,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import { ClientApp } from '@dukang/shared-types';
import { JwtAuthGuard } from './jwt-auth.guard';

@Injectable()
export class HqAuthGuard extends JwtAuthGuard implements CanActivate {
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const ok = await super.canActivate(context);
    if (!ok) return false;

    const req = context.switchToHttp().getRequest();
    const clientApp = req.headers['x-client-app'] as ClientApp;
    if (clientApp !== ClientApp.HQ_WEB) {
      throw new UnauthorizedException('Invalid client app for admin');
    }
    if (req.user?.actorType !== 'HQ') {
      throw new UnauthorizedException('HQ access required');
    }
    return true;
  }
}