src/lib/admin.ts

import { auth } from "./auth";
import { headers } from "next/headers";

/**
 * Admin authorization utility
 * 
 * This uses a simple environment variable-based allowlist of emails
 * to authorize ops admins. This avoids modifying the core user schema
 * and allows for quick rotation of admin access.
 */

/**
 * Gets the admin allowlist from environment variables
 */
function getAdminEmails(): string[] {
    return (process.env.ADMIN_EMAILS || "")
        .split(",")
        .map((e) => e.trim().toLowerCase())
        .filter(Boolean);
}

/**
 * Checks if an email is in the admin allowlist
 */
export function isAdminEmail(email: string | null | undefined): boolean {
    if (!email) return false;
    return getAdminEmails().includes(email.toLowerCase());
}

/**
 * Gets the current session and verifies it belongs to an admin
 * Returns the session if valid admin, null otherwise
 */
export async function getAdminSession() {
    const session = await auth.api.getSession({
        headers: await headers(),
    });

    if (!session?.user) {
        return null;
    }

    if (!isAdminEmail(session.user.email)) {
        return null;
    }

    return session;
}