import { NextRequest, NextResponse } from 'next/server';
import { verifyToken, type AdminRole } from '@/lib/auth';

export function getAuth(request: NextRequest): { role: AdminRole } | NextResponse {
  const token = request.cookies.get('admin_token')?.value;
  if (!token) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }
  const payload = verifyToken(token);
  if (!payload) {
    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 401 });
  }
  return { role: payload.role };
}

export function requireSuperAuth(request: NextRequest) {
  const auth = getAuth(request);
  if ('status' in auth) return auth;
  if (auth.role !== 'super_admin') {
    return NextResponse.json({ error: 'Super admin required' }, { status: 403 });
  }
  return auth;
}