import type { H3Event } from 'h3';
import { db } from '~~/server/lib/db';

/**
 * Like protectRoute(), but only lets admins through.
 *
 * The role is read from the database: the session cookie keeps a copy of the
 * user for a few minutes, and someone who just stopped being an admin should
 * not keep the access for that long.
 */
export const protectAdminRoute = async (event: H3Event) => {
    await protectRoute(event);

    const account = await db.query.users.findFirst({
        where: {
            id: event.context.user!.id as string,
        },
    });

    if (account?.role !== 'admin' || account.banned) {
        throw createError({
            statusCode: 403,
            statusMessage: 'Forbidden',
        });
    }
};