package middleware

import (
	"net/http"

	"github.com/gin-gonic/gin"

	"armature/auth"
	"armature/store"
)

// RequireAdmin returns middleware that restricts access to users with the
// surface.admin.access permission (i.e. members of the Admins group).
// Must be used after Auth() middleware which sets "user_id" in context.
func RequireAdmin(stores store.Stores) gin.HandlerFunc {
	return func(c *gin.Context) {
		userID := c.GetString("user_id")
		perms, err := resolveAndCachePerms(c, stores, userID)
		if err != nil || !perms[auth.PermSurfaceAdminAccess] {
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
				"error": "admin access required",
			})
			return
		}
		c.Next()
	}
}