edr-platform/apps/edr-passenger-api/src/common/iam.guard.ts

import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
import { Observable } from 'rxjs';

@Injectable()
export class IamGuard implements CanActivate {
  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    const request = context.switchToHttp().getRequest();
    const authHeader = request.headers.authorization;
    
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      throw new UnauthorizedException('No IAM token provided');
    }
    
    const token = authHeader.substring(7);
    
    // TODO: Implement actual IAM token validation
    // For now, just check if token exists
    if (!token) {
      throw new UnauthorizedException('Invalid IAM token');
    }
    
    // Add user info to request for downstream usage
    request.user = {
      id: 'iam-user-id',
      roles: ['AGENT'],
      permissions: []
    };
    
    return true;
  }
}