import { ForbiddenException } from '@nestjs/common';
import { UserRole } from '@prisma/client';
import { RequestUser } from './request-user';

export function resolveEstateScope(user: RequestUser, estateId?: string | null) {
  if (user.role === UserRole.SUPER_ADMIN) {
    if (!estateId) {
      throw new ForbiddenException('estateId is required for super admin requests');
    }
    return estateId;
  }

  if (!user.estateId || (estateId && estateId !== user.estateId)) {
    throw new ForbiddenException('Cross-estate access is not allowed');
  }

  return user.estateId;
}
