// lib/admin-check.ts
import { NextResponse } from 'next/server';
import { getServerSession } from 'next-auth';
import { authOptions } from './auth-options';

export async function requireAdmin() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.email) throw { status: 401, message: 'Unauthorized' };
  const role = (session as any).user.role ?? 'user';
  if (!(role === 'admin' || role === 'superadmin')) throw { status: 403, message: 'Forbidden' };
  return session;
}

/**
 * Route-handler variant: returns a JSON error response when the caller is not
 * an admin, or null when they are.
 */
export async function adminGuard(): Promise<NextResponse | null> {
  try {
    await requireAdmin();
    return null;
  } catch (err: any) {
    return NextResponse.json(
      { error: err?.message ?? 'Unauthorized' },
      { status: err?.status ?? 401 }
    );
  }
}