import { Injectable, CanActivate, ExecutionContext, Logger } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { PERMISSIONS_KEY } from 'common/decorators/permissions.decorator';
import { RoleService } from 'modules/role-permission/roles/role.service';

@Injectable()
export class PermissionsGuard implements CanActivate {
  private logger = new Logger(PermissionsGuard.name);

  constructor(
    private reflector: Reflector,
    private readonly roleService: RoleService,
  ) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    this.logger.debug('Checking permissions for request...');
    const requiredPermissions = this.reflector.get<string[]>(PERMISSIONS_KEY, context.getHandler()) || [];

    if (!requiredPermissions.length) {
      return true;
    }

    const request = context.switchToHttp().getRequest();
    const user = request.user;

    if (!user) return false;

    try {
      // Check if user has ANY of the required permissions (OR logic)
      for (const permission of requiredPermissions) {
        const hasPermission = await this.roleService.checkUserSubPermission(user.id, permission);
        if (hasPermission) {
          this.logger.debug(`User ${user.id} has permission: ${permission}`);
          return true;
        } 
      }

      return false;
    } catch (error) {
      this.logger.error(`Error checking permissions for user ${user.id}:`, error);
      return false;
    }
  }
}