import { HttpInterceptorFn } from '@angular/common/http';
import { currentRole } from './role';

/**
 * Dev-only: stamps role-aware requests with the current `?role=` as an `X-Role`
 * header so the backend can enforce the drafter/approver/admin rules. Only the
 * brief, org-template, stamdata and /me endpoints carry it (WP-23 widened the set —
 * /me must see the role or `AccessStore` could never learn a capability; WP-29 added
 * /stamdata, whose admin-only reads 403 without it); everything else is untouched.
 * A new admin-gated endpoint MUST be added here or its page silently 403s.
 */
const ROLE_AWARE = [
  '/api/v1/brief',
  '/api/v1/admin/org-template',
  '/api/v1/admin/cases',
  '/api/v1/admin/audit',
  '/api/v1/admin/flags',
  '/api/v1/stamdata',
  '/api/v1/me',
];

export const roleInterceptor: HttpInterceptorFn = (req, next) => {
  if (!ROLE_AWARE.some((prefix) => req.url.includes(prefix))) return next(req);
  return next(req.clone({ setHeaders: { 'X-Role': currentRole() } }));
};