// app/api/admin/create-course/route.ts
import { NextResponse } from 'next/server';
import { prisma } from '@/lib/prisma';
import { getServerSession } from 'next-auth';
import { authOptions } from '@/lib/auth-options';

async function checkAdmin() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.email) throw { status: 401, message: 'Unauthorized' };
  const allowed = (process.env.ALLOWED_ADMINS || '').split(',').map(s=>s.trim()).filter(Boolean);
  if (allowed.length && !allowed.includes(session.user.email)) throw { status: 403, message: 'Forbidden' };
}

export async function POST(req: Request) {
  try {
    await checkAdmin();
    const body = await req.json();
    const { title, code } = body;
    if (!title) return NextResponse.json({ error: 'missing title' }, { status: 400 });

    const course = await prisma.course.create({ data: { title, code } });
    return NextResponse.json({ course });
  } catch (err: any) {
    console.error(err);
    return NextResponse.json({ error: err?.message ?? 'server' }, { status: err?.status ?? 500 });
  }
}