import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';

@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;

    if (!user) {
      throw new ForbiddenException('请先登录');
    }

    // 检查用户是否具有管理员角色
    // 支持大小写: admin/ADMIN, super_admin/SUPER_ADMIN
    const role = user.role?.toLowerCase();
    const isAdmin = role === 'admin' || role === 'super_admin';

    if (!isAdmin) {
      throw new ForbiddenException('需要管理员权限');
    }

    return true;
  }
}
