// apps/web/src/lib/admin-guard.ts
// RSC용 admin 가드 — profile.role='admin' 체크, 실패 시 redirect

import { redirect } from 'next/navigation'
import { getSupabaseServerClient } from './supabase-server'

interface AdminProfile {
  id: string
  name: string | null
  role: string
}

export async function requireAdmin(): Promise<AdminProfile> {
  const supabase = await getSupabaseServerClient()
  const { data: { user } } = await supabase.auth.getUser()

  if (!user) {
    redirect('/login')
  }

  const { data: profile } = await supabase
    .from('profiles')
    .select('id, name, role')
    .eq('id', user.id)
    .maybeSingle()

  if (!profile || (profile as { role: string }).role !== 'admin') {
    redirect('/dashboard')
  }

  return profile as AdminProfile
}