import { UseGuards, applyDecorators } from '@nestjs/common';
import { AdminRoleGuard } from './admin-role.guard';

/**
 * `@RequireAdmin()` — semantic sugar for `@UseGuards(AdminRoleGuard)`.
 *
 * Applied at the controller (class) level so every route in an admin
 * controller is gated uniformly, or at the method level on the rare
 * route inside a mixed controller that needs admin. ADR-0020 §"Auth"
 * names this decorator alongside `@RequireMfa()`; we expose the
 * decorator API so both gates compose the same way in upcoming PRs.
 *
 * Using `applyDecorators` (instead of a one-line factory function)
 * leaves room for additional decorators in the same wrapper later —
 * e.g. an `@SetMetadata('rbac:requires', ['admin'])` for OpenAPI /
 * route-introspection tooling — without changing call sites.
 */
export function RequireAdmin(): ClassDecorator & MethodDecorator {
  return applyDecorators(UseGuards(AdminRoleGuard));
}
