import { Global, Module } from '@nestjs/common';
import { APP_GUARD, APP_INTERCEPTOR } from '@nestjs/core';
import { JwtModule } from '@nestjs/jwt';

import { AuditInterceptor } from './audit.interceptor';
import { PermissionCatalogService } from './catalog/permission-catalog.service';
import { JwtAuthGuard, PermissionGuard, ScopeGuard, SpecialPermissionGuard } from './guards';
import { PermissionService } from './permission.service';
import { RequestContextService } from './request-context';
import { ScopeResolver } from './scope/scope-resolver.service';
import { TokenService } from './token.service';

/**
 * 全局安全能力：请求上下文（AsyncLocalStorage）、权限解析、数据范围解析、JWT 与守卫链。
 * 守卫顺序：JwtAuthGuard → PermissionGuard → SpecialPermissionGuard → ScopeGuard。
 *
 * `CUSTOMER_DIRECTORY` 由全局 ClientModule 提供真实实现（A3）；
 * ScopeResolver / 守卫链只依赖端口，不感知客户模块。
 */
@Global()
@Module({
  imports: [JwtModule.register({})],
  providers: [
    RequestContextService,
    PermissionService,
    PermissionCatalogService,
    PermissionGuard,
    ScopeResolver,
    TokenService,
    AuditInterceptor,
    JwtAuthGuard,
    SpecialPermissionGuard,
    ScopeGuard,
    { provide: APP_GUARD, useExisting: JwtAuthGuard },
    { provide: APP_GUARD, useExisting: PermissionGuard },
    { provide: APP_GUARD, useExisting: SpecialPermissionGuard },
    { provide: APP_GUARD, useExisting: ScopeGuard },
    { provide: APP_INTERCEPTOR, useExisting: AuditInterceptor },
  ],
  exports: [
    RequestContextService,
    PermissionService,
    PermissionCatalogService,
    ScopeResolver,
    TokenService,
  ],
})
export class SecurityModule {}