import { isStaff } from "@/lib/admin/is-staff";
import { redirectSafe } from "@/lib/foundation/security";
import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
import { clientIp, rateLimit } from "@/lib/rate-limit";

export { isStaff };

export interface StaffUser {
	id: number;
	rank: number;
	username: string;
}

export async function requireStaff(): Promise<StaffUser> {
	const { session, permissions } = await getAdminContext();
	if (!canAccess(permissions, PERMS.ADMIN_DASHBOARD, session.user.rank))
		redirectSafe("/", "/");
	return {
		id: session.user.id,
		rank: session.user.rank,
		username: session.user.username,
	};
}

export async function requireStaffRateLimited(): Promise<StaffUser> {
	const staff = await requireStaff();
	const ip = await clientIp();
	if (!(await rateLimit(`admin:${staff.id}:${ip}`, 30, 60_000)).ok)
		redirectSafe("/admin?error=ratelimit", "/admin");
	return staff;
}