import { SetMetadata } from '@nestjs/common';

export const REQUIRE_SCOPES_KEY = 'planfi:require_scopes';

/**
 * Optional defense-in-depth. Declares the named scope(s) a service key SHOULD also hold.
 * The permission matrix (route x method, §4.6) is the authoritative enforcement; scopes are
 * passed to Laravel as `required_scope` (the first scope) for extra verification + audit labelling.
 *
 * @example
 *   @RequireScopes('bff:audit-events:write')
 *   @Post()
 *   create() {}
 */
export const RequireScopes = (...scopes: string[]) =>
  SetMetadata(REQUIRE_SCOPES_KEY, scopes);