import { ForbiddenException, Injectable } from "@nestjs/common";
import type { CanActivate, ExecutionContext } from "@nestjs/common";

type RequestWithUserRole = {
  user?: { role?: string };
};

@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<RequestWithUserRole>();
    const role = request?.user?.role;
    if (role !== "ADMIN") {
      throw new ForbiddenException("Admin access required");
    }
    return true;
  }
}
