import "server-only";
import { headers } from "next/headers";
import { redirect } from "next/navigation";
import { auth, type AuthUser } from "@/lib/auth";
import { isAdminEmail } from "@/lib/env";

export async function getSession() {
  return auth.api.getSession({ headers: await headers() });
}

/** Server components / actions: redirect to login when not authenticated or unverified. */
export async function requireUser(): Promise<AuthUser> {
  const session = await getSession();
  // ?expired=1 lets the proxy clear a stale cookie instead of redirecting straight back to /app.
  if (!session) redirect("/login?expired=1");
  if (!session.user.emailVerified) redirect("/verify-email");
  return session.user;
}

/** Route handlers: return the user or null (no redirect). */
export async function getUserFromRequest(req: Request): Promise<AuthUser | null> {
  const session = await auth.api.getSession({ headers: req.headers });
  if (!session || !session.user.emailVerified) return null;
  return session.user;
}

export function isAdmin(user: { email: string; role?: string | null }): boolean {
  return user.role === "admin" || isAdminEmail(user.email);
}

export async function requireAdmin(): Promise<AuthUser> {
  const user = await requireUser();
  if (!isAdmin(user)) redirect("/app");
  return user;
}