// server/supabase/functions/_shared/admin-auth.ts
// Admin/Super-admin 권한 검증 — requireUser 확장

// @ts-expect-error — Deno 런타임 import
import type { User } from 'https://esm.sh/@supabase/supabase-js@2.39.7'
import { requireUser, type AuthError } from './auth.ts'

export type AdminRole = 'admin' | 'super_admin'

/**
 * admin 이상 권한 필요 (admin, super_admin).
 * 실패 시 AuthError throw.
 */
export async function requireAdmin(req: Request): Promise<User> {
  const user = await requireUser(req)
  const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
  if (role !== 'admin' && role !== 'super_admin') {
    // eslint-disable-next-line @typescript-eslint/no-throw-literal
    throw { status: 403, message: 'Admin access required' } as AuthError
  }
  return user
}

/**
 * super_admin 전용 권한 필요.
 * 실패 시 AuthError throw.
 */
export async function requireSuperAdmin(req: Request): Promise<User> {
  const user = await requireUser(req)
  const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
  if (role !== 'super_admin') {
    // eslint-disable-next-line @typescript-eslint/no-throw-literal
    throw { status: 403, message: 'Super admin access required' } as AuthError
  }
  return user
}

/**
 * 현재 유저의 admin role 반환. admin이 아니면 null.
 */
export function getAdminRole(user: User): AdminRole | null {
  const role = (user.app_metadata as Record<string, unknown>)?.role as string | undefined
  if (role === 'admin' || role === 'super_admin') return role
  return null
}