import { NextResponse } from 'next/server';

import type { AdminUserRow } from '@/lib/auth/session';
import { getSessionUser } from '@/lib/auth/session';

export async function requireAdminApi(): Promise<
  { ok: true; user: AdminUserRow } | { ok: false; response: NextResponse }
> {
  const user = await getSessionUser();
  if (!user) {
    return { ok: false, response: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) };
  }
  if (!user.is_approved) {
    return { ok: false, response: NextResponse.json({ error: 'Pending approval' }, { status: 403 }) };
  }
  if (!user.is_admin) {
    return { ok: false, response: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) };
  }
  return { ok: true, user };
}
