import {
  CanActivate,
  ExecutionContext,
  ForbiddenException,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { UserData } from '../../user/entity/user.entity';
import { InjectEntityManager } from '@nestjs/typeorm';
import { EntityManager } from 'typeorm';

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(
    private reflector: Reflector,
    @InjectEntityManager() private entityManager: EntityManager,
  ) {}

  async canActivate(context: ExecutionContext) {
    const request = context
      .switchToHttp()
      .getRequest<Request & { user: any }>();
    const object = request.user;

    const users: UserData = await this.entityManager.query(
      `SELECT * FROM sso_user WHERE id = ${object.userId} LIMIT 1`,
    );

    const user = users[0];
    if (!user || !user['role_id']) {
      throw new UnauthorizedException('User not authorized');
    }

    const requiredModule = this.reflector.get<string>(
      'moduleCode',
      context.getHandler(),
    );
    const requiredActions = this.reflector.get<string>(
      'actions',
      context.getHandler(),
    );

    const roleAccess = await this.entityManager.query(
      `SELECT *
             FROM sso_module_access
             WHERE role_id = ${user['role_id']}
               AND module_code = '${requiredModule}'`,
    );

    if (!roleAccess || roleAccess.length === 0) {
      throw new ForbiddenException(
        'Access denied: No permissions found for this module',
      );
    }

    const hasAccess = roleAccess.some(
      (access) =>
        requiredActions.includes(access.action_type) &&
        access.access_flag === 1,
    );

    if (!hasAccess) {
      throw new ForbiddenException('Access denied: Insufficient permissions.');
    }
    return true;
  }
}