import { auth } from "@/auth";
import { PipelineError } from "./errors";

export type SessionUser = { id: string; role: string; name?: string | null; email?: string | null };

/** Any signed-in studio user (clients never see pipeline pages). */
export async function requirePipelineUser(): Promise<SessionUser> {
  const session = await auth();
  const user = session?.user as (SessionUser & { role?: string }) | undefined;
  if (!user?.id) throw new PipelineError(401, "Unauthorized");
  if (user.role === "CLIENT") throw new PipelineError(403, "Forbidden");
  return user as SessionUser;
}

/** Admin-level pipeline actions (machine kill-switch, manual mark-done). */
export async function requirePipelineAdmin(): Promise<SessionUser> {
  const user = await requirePipelineUser();
  if (!["ADMIN", "PRODUCER", "SUPERVISOR"].includes(user.role)) {
    throw new PipelineError(403, "Forbidden — requires admin/producer/supervisor role");
  }
  return user;
}