import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common';

/**
 * Verifies the JWT is valid (handled by JwtStrategy) and that user has admin role.
 * Use after JwtAuthGuard: @UseGuards(JwtAuthGuard, AdminGuard)
 */
@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    if (!user) throw new UnauthorizedException('未认证');
    if (user.role !== 'admin') throw new ForbiddenException('需要管理员权限');
    return true;
  }
}
