import { inject } from '@angular/core';
import { CanActivateFn } from '@angular/router';
import { map } from 'rxjs/operators';
import { PERMISSION_GATEWAY } from '../services/permission-gateway.token';

/**
 * Route guard shape for docs/backend/TRACK-S-SECURITY-RBAC-CONTRACT.md §2.
 * Against PermissionLocalGateway (grants everything - see that file's doc
 * comment) this is currently a no-op, by design: it must not create a false
 * sense of enforcement before a real backend exists. Attach via route data
 * (`data: { requiredScope: '...' }`) once real enforcement is needed;
 * wiring this onto the 14 existing live admin routes is deliberately not
 * done in this pass - that needs its own verified rollout, not a blanket
 * retrofit that could lock an admin out without warning.
 */
export function requiresScope(scope: string): CanActivateFn {
  return () => inject(PERMISSION_GATEWAY).getSessionPermissions().pipe(
    map(permissions => permissions.scopes.includes('*') || permissions.scopes.includes(scope))
  );
}
