import { createClient } from '@/lib/supabase/server'
import type { SupabaseClient } from '@supabase/supabase-js'
import type { User } from '@supabase/supabase-js'

// Shared guard for /api/admin/* routes: resolves the session and requires
// the admin role. Returns user: null when the caller must respond 403.
export async function requireAdmin(): Promise<{
  supabase: SupabaseClient
  user: User | null
}> {
  const supabase = await createClient()
  const { data: { user }, error } = await supabase.auth.getUser()
  if (error || !user) return { supabase, user: null }
  const { data: profile } = await supabase
    .from('users').select('role').eq('id', user.id).single()
  if (!profile || profile.role !== 'admin') return { supabase, user: null }
  return { supabase, user }
}