import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { Request } from 'express';

const API_KEY = 'SYAFANA_KEY_123';

@Injectable()
export class ApiKeyGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<Request>();
    
    // Check Header
    let key = request.header('X-API-KEY') || request.header('x-api-key');
    
    // Check Query Param
    if (!key) {
      key = request.query.api_key as string;
    }
    
    // Check Body
    if (!key && request.body) {
      key = request.body.api_key;
    }
    
    if (key === API_KEY) {
      return true;
    }
    
    throw new UnauthorizedException({
      status: 'error',
      message: 'Unauthorized. Akses ditolak karena API Key (X-API-KEY) tidak valid atau tidak disertakan.'
    });
  }
}