middleware/admin_guard.py

from fastapi import HTTPException, Depends
from middleware.get_current_user import get_current_user


async def get_current_admin_user(current_user: dict = Depends(get_current_user)):
    """
    Professional role-based admin guard.
    Checks if the authenticated user has 'admin' role.
    No hardcoded emails - relies purely on role assignment in database.
    """
    if not current_user:
        raise HTTPException(status_code=401, detail="User not authenticated")

    # ✅ Double-check: Admin must also be verified and active
    if not current_user.get("is_verified", False) or current_user.get("status") != "active":
        raise HTTPException(
            status_code=403, 
            detail="Account not verified or inactive. Access denied."
        )

    if current_user.get("role") != "admin":
        raise HTTPException(
            status_code=403,
            detail="Access denied. Admin privileges required."
        )

    return current_user