import { createParamDecorator, ExecutionContext, SetMetadata } from '@nestjs/common';
import { Permission, FeatureKey } from '@wms/shared';
import { getRequestContext, RequestContext } from '@/common/context/request-context';

export const IS_PUBLIC_KEY = 'auth:public';
export const PERMISSIONS_KEY = 'auth:permissions';
export const FEATURE_KEY = 'auth:feature';
export const PLATFORM_ONLY_KEY = 'auth:platform';
export const API_KEY_SCOPES_KEY = 'auth:apiScopes';
export const ALLOW_API_KEY = 'auth:allowApiKey';

/** Endpoint needs no authentication (login, health). */
export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

/** Caller must hold ALL listed permissions (wildcards honoured). */
export const RequirePermissions = (...permissions: Permission[]) => SetMetadata(PERMISSIONS_KEY, permissions);

/** Tenant must have the feature flag enabled. */
export const RequireFeature = (feature: FeatureKey) => SetMetadata(FEATURE_KEY, feature);

/** Only platform (SaaS operator) staff. */
export const PlatformOnly = () => SetMetadata(PLATFORM_ONLY_KEY, true);

/** Endpoint accepts API-key authentication with the given scopes (public integration API). */
export const ApiKeyScopes = (...scopes: string[]) => SetMetadata(API_KEY_SCOPES_KEY, scopes);

/** Injects the current RequestContext. */
export const Ctx = createParamDecorator((_data: unknown, _ctx: ExecutionContext): RequestContext => {
  const c = getRequestContext();
  if (!c) throw new Error('Request context missing');
  return c;
});