import type { SupabaseClient, User } from '@supabase/supabase-js'
import { AdminPublicError, actorEmail, adminRpcError } from './admin-contract.ts'

export type CurrentAdminRole = 'manager' | 'admin' | 'super_admin'

export async function verifyCurrentAdminActor(
  serviceClient: SupabaseClient,
  user: User,
  minimumRole: CurrentAdminRole = 'manager',
): Promise<void> {
  const { data, error } = await serviceClient.rpc('resolve_external_admin_actor_v1', {
    p_email: actorEmail(user),
    p_minimum_role: minimumRole,
  })
  if (error) throw adminRpcError(error)

  const actor = Array.isArray(data) ? data[0] as Record<string, unknown> | undefined : undefined
  if (!actor || typeof actor.actor_id !== 'string' ||
      (actor.actor_role !== 'manager' && actor.actor_role !== 'admin' && actor.actor_role !== 'super_admin')) {
    throw new AdminPublicError(502, 'invalid_admin_rpc_response')
  }
}