import type { H3Event } from 'h3';

/**
 * Like protectRoute(), but only lets admins through.
 *
 * protectRoute() reads the user from the database on every request, so someone
 * who just stopped being an admin loses the access right away.
 */
export const protectAdminRoute = async (event: H3Event) => {
    const sessionData = await protectRoute(event);

    if (sessionData.user.role !== 'admin') {
        throw createError({
            statusCode: 403,
            statusMessage: 'Forbidden',
        });
    }

    return sessionData;
};