import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
import { PrismaService } from '../prisma/prisma.service';
import type { Actor } from '../common/record-scope';

@Injectable()
export class TreasuryAccessGuard implements CanActivate {
  constructor(private readonly prisma: PrismaService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const req = context.switchToHttp().getRequest<{ user?: Actor; originalUrl?: string; url?: string }>();
    const actor = req.user;
    if (!actor) throw new ForbiddenException('دسترسی مالی مجاز نیست.');
    const url = req.originalUrl || req.url || '';
    const payroll = url.includes('/treasury/payroll');
    if (actor.role === 'owner' || actor.role === 'admin') return true;
    const membership = await this.prisma.membership.findFirst({
      where: { userId: actor.userId, organizationId: actor.organizationId, isActive: true },
      select: { orgRole: { select: { permissions: true } } },
    });
    const permissions = Array.isArray(membership?.orgRole?.permissions)
      ? membership.orgRole.permissions.map(String)
      : [];
    const allowed = payroll
      ? permissions.includes('treasury_payroll')
      : permissions.includes('treasury') || permissions.includes('treasury_payroll');
    if (!allowed) throw new ForbiddenException('دسترسی مالی برای نقش شما مجاز نیست.');
    return true;
  }
}