import { inject } from '@angular/core';
import { CanActivateFn } from '@angular/router';
import { AdminAuthService } from '@marketplaces/auth';
import { AdminPermissionsService } from './admin-permissions.service';

/**
 * UI-only gate for a specific permission, on top of the package's
 * adminAuthGuard authentication check. See AdminPermissionsService for why
 * this is cosmetic until the backend ships real admin-role enforcement.
 * Kept app-local because it depends on AdminPermissionsService, which reads
 * this app's mock Users domain - not a portable auth concern.
 */
export function requireAdminPermission(permission: string): CanActivateFn {
  return () => {
    const adminAuth = inject(AdminAuthService);
    const permissions = inject(AdminPermissionsService);

    if (!adminAuth.isAuthenticated()) {
      adminAuth.requestLogin();
      return false;
    }

    return permissions.has(permission);
  };
}
