import { NextResponse } from "next/server";
import { getCurrentSession } from "./session";

/** Guard for API route handlers — returns the session, or a 401 response to return as-is. */
export async function requireSession() {
  const session = await getCurrentSession();
  if (!session) {
    return { session: null, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
  }
  return { session, response: null };
}

/** Same as requireSession, but also requires role === "admin" — for account/LDAP management. */
export async function requireAdminSession() {
  const session = await getCurrentSession();
  if (!session) {
    return { session: null, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
  }
  if (session.user.role !== "admin") {
    return { session: null, response: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
  }
  return { session, response: null };
}