import { SetMetadata } from '@nestjs/common';
import type { AuthenticatedUser } from './authenticated-user';

export const ROLES_KEY = 'roles';

/**
 * Restrict a controller or handler to the listed roles. Applied on top of the
 * session guard, so an unauthenticated request is rejected before this runs.
 */
export const Roles = (...roles: AuthenticatedUser['role'][]) => SetMetadata(ROLES_KEY, roles);