import { ForbiddenException, createParamDecorator, ExecutionContext } from '@nestjs/common';
import type { SessionRequest } from './session-validation.middleware';

/**
 * Returns the tenant bound to the authenticated client session.
 * Request headers, query parameters and request bodies must never determine this value.
 */
export const CurrentTenantId = createParamDecorator((_: unknown, context: ExecutionContext) => {
  const request = context.switchToHttp().getRequest<SessionRequest>();
  if (request.authSession?.portal !== 'client' || !request.sessionTenantId) {
    throw new ForbiddenException({ code: 'CLIENT_TENANT_REQUIRED', message: '缺少可信企业上下文' });
  }
  return request.sessionTenantId;
});