/**
 * Admin-plane permission middleware + role resolution — admin-dashboard.
 *
 * requireAdminPermission(perm): Hono middleware that checks
 * `AdminSessionPayload.permissions` for the given permission key. Must be
 * mounted AFTER requireAdminSession().
 *
 * Note: AdminSessionPayload is extended by the admin-dashboard module to
 * include a `permissions` array. Until that extension lands in the types
 * package barrel, we cast the session payload here.
 */
import type { MiddlewareHandler } from 'hono'
import type { AdminSessionPayload } from '@zync/types'

/** Extended admin session that includes resolved permissions. */
export interface AdminSessionWithPermissions extends AdminSessionPayload {
  permissions: string[]
}

function isAdminSession(s: unknown): s is AdminSessionWithPermissions {
  return (
    typeof s === 'object' &&
    s !== null &&
    (s as Record<string, unknown>).type === 'admin' &&
    (s as Record<string, unknown>).totp_verified === true
  )
}

/**
 * Hono middleware that enforces a specific admin permission.
 * Must be applied AFTER requireAdminSession().
 *
 * Returns 403 { error: 'Forbidden', requiredPermission } if the admin session
 * does not include the required permission. 401 if no session is present.
 */
export function requireAdminPermission(permission: string): MiddlewareHandler {
  return async (c, next) => {
    const session = c.get('session') as unknown

    if (!isAdminSession(session)) {
      return c.json({ error: 'Admin authentication required' }, 401)
    }

    const permissions: string[] = session.permissions ?? []

    if (!permissions.includes(permission)) {
      return c.json(
        { error: 'Forbidden', requiredPermission: permission },
        403,
      )
    }

    await next()
  }
}