import { redirect } from "next/navigation";
import { headers } from "next/headers";
import { auth } from "@/lib/auth/server";
import { db, users, eq } from "@epicure/db";

export type StaffRole = "admin" | "moderator";

/** Server-component equivalent of requireAdmin/lib/api-auth.ts — used by
 * admin/layout.tsx to gate entry to the whole /admin tree (admin AND
 * moderator both pass) and by individual page components that need to
 * additionally restrict themselves to admin only. Always re-queries the
 * role fresh, same reasoning as requireAdmin: session.user.role comes from
 * a 5-minute cookieCache. */
export async function getStaffRole(): Promise<StaffRole | null> {
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session) return null;
  const [dbUser] = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id)).limit(1);
  if (dbUser?.role === "admin" || dbUser?.role === "moderator") return dbUser.role;
  return null;
}

/** Redirects moderators to /admin/reports (their only allowed landing area)
 * and non-staff to /recipes. Call at the top of any admin page that should
 * stay admin-only. */
export async function requireFullAdminPage(): Promise<void> {
  const role = await getStaffRole();
  if (role === "moderator") redirect("/admin/reports");
  if (role !== "admin") redirect("/recipes");
}