import { getSession } from '@/lib/auth/get-session'
import type { SessionPayload } from '@/lib/auth/session'

// Shared guard for /api/admin/* routes: resolves the session and requires
// the admin role. Returns session: null when the caller must respond 403.
export async function requireAdmin(): Promise<{
  session: SessionPayload | null
}> {
  const session = await getSession()
  if (!session || session.role !== 'admin') return { session: null }
  return { session }
}