import type { Request, Response, NextFunction } from "express";
import { verificarToken } from "./auth.js";

export async function exigirEditor(req: Request, res: Response, next: NextFunction) {
  const token = req.cookies?.["biblioteca_sessao"] as string | undefined;
  const sessao = token ? await verificarToken(token) : null;

  if (!sessao || (sessao.papel !== "editor" && sessao.papel !== "admin")) {
    res.status(403).json({ erro: "Acesso restrito a editores." });
    return;
  }

  next();
}
