import { HttpInterceptorFn } from '@angular/common/http';
import { inject } from '@angular/core';
import { AdminAuthService } from './admin-auth.service';

/** Backend paths that require an active AdminWebSessionID per API-REFERENCE.md §0. */
const ADMIN_GATED_PATH_SEGMENTS = ['/admin/', '/backoffice/', '/builder/', '/media/'];

/**
 * Attaches admin session/token headers only to admin API requests. Mirrors
 * apiHeadersInterceptor's self-guarding pattern but scoped to admin-gated
 * paths so it never touches customer requests and never reads AuthService's
 * session.
 */
export const adminAuthHeadersInterceptor: HttpInterceptorFn = (req, next) => {
  const isAdminRequest = ADMIN_GATED_PATH_SEGMENTS.some(segment => req.url.includes(segment));
  if (!isAdminRequest) {
    return next(req);
  }

  const adminAuth = inject(AdminAuthService);
  const session = adminAuth.session();
  const token = adminAuth.getAdminToken();

  let headers = req.headers;
  if (session?.sessionId) {
    headers = headers.set('AdminWebSessionID', session.sessionId);
  }
  if (token) {
    headers = headers.set('Authorization', `Bearer ${token}`);
  }

  return next(req.clone({ headers }));
};
