import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from "@nestjs/common";
import { Observable } from "rxjs";
import { ActorContext } from "../actor-context.js";

/**
 * Global interceptor (TASK-0127): binds the request's `req.auth` (set by the
 * global AuthGuard, which runs before interceptors) into the AsyncLocalStorage
 * actor context so `assertCan`/`assertRole` can apply API-key scope rules
 * without signature changes at the 81+ service call sites.
 *
 * Registered FIRST among APP_INTERCEPTORs (outermost) in AppModule — the
 * actor must be bound before any inner interceptor or handler runs.
 */
@Injectable()
export class ActorContextInterceptor implements NestInterceptor {
  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
    const req = context.switchToHttp().getRequest<{ auth?: unknown }>();
    return ActorContext.run(req.auth as never, () => next.handle());
  }
}