"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.JwtAuthGuard = void 0;
const common_1 = require("@nestjs/common");
const core_1 = require("@nestjs/core");
const jwt_1 = require("@nestjs/jwt");
const config_1 = require("@nestjs/config");
const auth_decorators_1 = require("../decorators/auth.decorators");
const jwt_secret_1 = require("../utils/jwt-secret");
let JwtAuthGuard = class JwtAuthGuard {
    reflector;
    jwtService;
    config;
    constructor(reflector, jwtService, config) {
        this.reflector = reflector;
        this.jwtService = jwtService;
        this.config = config;
    }
    async canActivate(context) {
        const isPublic = this.reflector.getAllAndOverride(auth_decorators_1.IS_PUBLIC_KEY, [
            context.getHandler(),
            context.getClass(),
        ]);
        if (isPublic)
            return true;
        const request = context.switchToHttp().getRequest();
        const authHeader = request.headers.authorization;
        if (!authHeader?.startsWith('Bearer ')) {
            throw new common_1.UnauthorizedException('توکن احراز هویت الزامی است');
        }
        const token = authHeader.slice(7);
        let payload;
        try {
            payload = await this.jwtService.verifyAsync(token, {
                secret: (0, jwt_secret_1.resolveJwtSecret)(this.config),
            });
        }
        catch {
            throw new common_1.UnauthorizedException('توکن نامعتبر یا منقضی شده است');
        }
        const user = {
            id: payload.sub ?? payload.id,
            type: payload.type,
            role: payload.role,
            phone: payload.phone,
        };
        request.user = user;
        const authType = this.reflector.getAllAndOverride(auth_decorators_1.AUTH_TYPE_KEY, [context.getHandler(), context.getClass()]);
        if (authType && authType !== 'any' && user.type !== authType) {
            throw new common_1.ForbiddenException('دسترسی مجاز نیست');
        }
        const roles = this.reflector.getAllAndOverride(auth_decorators_1.ROLES_KEY, [
            context.getHandler(),
            context.getClass(),
        ]);
        if (roles?.length && (!user.role || !roles.includes(user.role))) {
            throw new common_1.ForbiddenException('نقش کاربری کافی نیست');
        }
        return true;
    }
};
exports.JwtAuthGuard = JwtAuthGuard;
exports.JwtAuthGuard = JwtAuthGuard = __decorate([
    (0, common_1.Injectable)(),
    __metadata("design:paramtypes", [core_1.Reflector,
        jwt_1.JwtService,
        config_1.ConfigService])
], JwtAuthGuard);
//# sourceMappingURL=jwt-auth.guard.js.map