import {
    applyDecorators,
    CanActivate,
    ExecutionContext, HttpException, HttpStatus,
    Injectable,
    SetMetadata,
    UnauthorizedException, UseGuards
} from "@nestjs/common";
import {Observable} from "rxjs";
import {JwtService} from "@nestjs/jwt";
import {UserRolesEnum} from "../user/enums/user-roles.enum";
import {Reflector} from "@nestjs/core";

export function Auth(...roles: string[]) {
    return applyDecorators(
        SetMetadata('roles', roles),
        UseGuards(AuthGuard)
    );
}

@Injectable()
class AuthGuard implements CanActivate {
    constructor(private jwtService: JwtService,
                private reflector: Reflector) {}

    canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean> {
        const req = context.switchToHttp().getRequest()
        try {

            //Верефикация JWT токена
            const authHeader = req.headers.authorization;
            const bearer = authHeader.split(' ')[0]
            const token = authHeader.split(' ')[1]

            if (bearer !== 'Bearer' || !token) {
                throw new UnauthorizedException({message: 'Пользователь не авторизован'})
            }

            const user = this.jwtService.verify(token);
            req.user = user;

            //Проверка роли
            try {
                const roles = this.reflector.get<string[]>('roles', context.getHandler());
                if (!roles) {
                    return true;
                }

                return user.roles.some(role => roles.includes(role.value));
            } catch (e) {
                throw new HttpException( 'Нет доступа', HttpStatus.FORBIDDEN)
            }

            return true;
        } catch (e) {
            throw new UnauthorizedException({message: 'Пользователь не авторизован'})
        }
    }

}