import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';

import type { AuthedRequest } from '../auth/auth.guard';

/**
 * Second-stage guard for /admin routes: AuthGuard has already attached
 * the user; this one requires the Site Admin flag (permissions.md).
 */
@Injectable()
export class SiteAdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<AuthedRequest>();
    if (!request.user?.isSiteAdmin) throw new ForbiddenException();
    return true;
  }
}