using Backend.Services;

namespace Backend.Security;

public sealed class AdminSessionFilter(IUserSessionService userSessionService) : IEndpointFilter
{
    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
    {
        var session = await userSessionService.ResolveSessionAsync(context.HttpContext, context.HttpContext.RequestAborted);
        if (session is null)
        {
            return Results.Unauthorized();
        }

        if (!AdminRoles.CanAccessAdmin(session.Role))
        {
            return Results.Json(new { message = "Admin access requires an elevated role." }, statusCode: StatusCodes.Status403Forbidden);
        }

        context.HttpContext.SetCurrentSession(session);
        return await next(context);
    }
}