/**
 * content RouterAuthGuard 包装（v2.1 ADR-036）
 *
 * 仅作用于 /graphql 端点，REST 路由放行（已有 PermissionGuard）。
 */
import { Injectable, ExecutionContext } from "@nestjs/common";
import {
  RouterAuthGuard as BaseRouterAuthGuard,
  type RouterAuthConfig,
} from "@edu/shared-ts/federation";

@Injectable()
export class RouterAuthGuard extends BaseRouterAuthGuard {
  constructor() {
    const config: RouterAuthConfig = {
      secret: process.env.ROUTER_AUTH_SECRET ?? "",
      devMode: process.env.DEV_MODE === "true",
    };
    super(config);
  }

  override canActivate(ctx: ExecutionContext): boolean {
    // DEV_MODE 优先放行（开发态跳过所有校验）
    if (process.env.DEV_MODE === "true") {
      return true;
    }

    const req = ctx.switchToHttp().getRequest<{
      url: string;
    }>();

    // 仅 GraphQL 端点需要校验，REST 路由放行
    if (!req?.url?.startsWith("/graphql")) {
      return true;
    }

    return super.canActivate(ctx);
  }
}