// src/middleware/auth.js
// Authentication middleware for admin panel access control

/**
 * Require admin authentication - checks if logged-in user is in Trinity whitelist
 * @param {Object} req - Express request
 * @param {Object} res - Express response
 * @param {Function} next - Express next function
 */
function requireAdmin(req, res, next) {
    // This assumes your existing OAuth flow stores the logged-in user's ID in a session
    const userId = req.session?.discordId; 
    
    if (!userId) {
        return res.redirect('/admin/login');
    }

    const adminIds = process.env.ADMIN_DISCORD_IDS.split(',');
    
    if (adminIds.includes(userId)) {
        return next();
    }

    return res.status(403).send('Forbidden: You do not have admin access.');
}

module.exports = { requireAdmin };
