import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';

// Runs after AdminAuthGuard, which attaches request.admin.
@Injectable()
export class SuperAdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const { admin } = context.switchToHttp().getRequest();
    if (!admin || admin.role !== 'super_admin') {
      throw new ForbiddenException('Access denied: super admin role required.');
    }
    return true;
  }
}