src/middleware/authorize.ts

import { Response, NextFunction } from 'express';
import { supabase } from '../config/supabase';
import { AuthRequest } from './auth';
import { logActivity } from '../services/activityLog';

export const authorizeAdmin = async (req: AuthRequest, res: Response, next: NextFunction) => {
  try {
    const { data: prof, error } = await supabase
      .from('profiles')
      .select('role')
      .eq('id', req.userId!)
      .single();

    if (error || prof?.role !== 'admin') {
      logActivity({
        user_id: req.userId,
        action: 'PRIVILEGE_ESCALATION',
        details: `Non-admin user attempted ${req.method} ${req.originalUrl}`,
        ip: req.ip,
        user_agent: req.get('user-agent'),
      });
      res.status(403).json({
        success: false,
        error: { code: 'FORBIDDEN', message: 'Admin access required' },
      });
      return;
    }
    next();
  } catch {
    res.status(500).json({
      success: false,
      error: { code: 'INTERNAL_ERROR', message: 'Authorization check failed' },
    });
  }
};