// lib/admin-check.ts
import { getServerSession } from 'next-auth';
import { authOptions } from './auth-options';

export async function requireAdmin() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.email) throw { status: 401, message: 'Unauthorized' };
  const role = (session as any).user.role ?? 'user';
  if (!(role === 'admin' || role === 'superadmin')) throw { status: 403, message: 'Forbidden' };
  return session;
}