'use strict';

function isApi(req) {
  return (req.originalUrl || req.url).startsWith('/api/');
}

function requireAuth(req, res, next) {
  if (req.session && req.session.user) return next();
  if (isApi(req)) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  return res.redirect('/login.html');
}

function requireAdmin(req, res, next) {
  if (req.session && req.session.user && req.session.user.role === 'admin') {
    return next();
  }
  if (isApi(req)) {
    return res.status(403).json({ error: 'Admin access required' });
  }
  return res.status(403).send('Forbidden: admin access required.');
}

module.exports = { requireAuth, requireAdmin };