import { SetMetadata } from '@nestjs/common';

export const ALLOW_AUTH_KEY = 'planfi:allow_auth';

/** Authentication mechanisms a route accepts. */
export type AllowedAuthType = 'user_jwt' | 'client_jwt' | 'service_key';

/**
 * Declares which auth mechanisms a route accepts. The ServiceCredentialGuard always tries the
 * service-key path first (header `X-Planfi-Service-Key`); when a JWT type is listed it falls
 * through to the existing JWT guards (composed like MultiAuthGuard).
 *
 * Default when the decorator is absent: ['service_key'] only (fail-closed, key-only).
 *
 * @example
 *   @AllowAuth(['service_key', 'user_jwt'])
 *   @Post()
 *   create() {}
 */
export const AllowAuth = (types: AllowedAuthType[]) =>
  SetMetadata(ALLOW_AUTH_KEY, types);