import type { MiddlewareHandler } from 'hono'
import type { AppEnv } from '@/types/hono'

function getSuperAdminEmails(): Set<string> {
  const raw = Bun.env.SUPER_ADMIN_EMAILS ?? ''
  const emails = raw
    .split(',')
    .map((value) => value.trim().toLowerCase())
    .filter(Boolean)
  return new Set(emails)
}

export const requireSuperAdmin: MiddlewareHandler<AppEnv> = async (
  c,
  next,
) => {
  const authUser = c.get('authUser')
  const role =
    typeof authUser.app_metadata?.role === 'string'
      ? authUser.app_metadata.role
      : null
  const email = authUser.email?.toLowerCase()

  if (role === 'super_admin') {
    await next()
    return
  }

  if (email && getSuperAdminEmails().has(email)) {
    await next()
    return
  }

  return c.json({ message: 'Este recurso requiere permisos de super admin.' }, 403)
}