import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { SubscriptionEngineService } from './subscription-engine.service';
import { REQUIRE_PERMISSION_KEY, CHECK_LIMIT_KEY } from './subscription.decorator';

@Injectable()
export class SubscriptionGuard implements CanActivate {
  constructor(
    private readonly reflector: Reflector,
    private readonly subscriptionEngine: SubscriptionEngineService,
  ) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const user = request.user; // populated by JwtAuthGuard

    // If no authenticated user (e.g. public endpoint), allow access (let other guards handle auth)
    if (!user || !user.id) {
      return true;
    }

    const requiredPermission = this.reflector.get<string>(
      REQUIRE_PERMISSION_KEY,
      context.getHandler(),
    );

    const checkLimit = this.reflector.get<string>(
      CHECK_LIMIT_KEY,
      context.getHandler(),
    );

    // Call the central validation engine
    await this.subscriptionEngine.validateRequest(user.id, requiredPermission, checkLimit);

    return true;
  }
}