import {requireAppAccess} from '../admin/admin.middleware.js';

/**
 * Mirrors the Feedback module's feedback.auth.ts: this is the ONLY place in
 * the tickets module that knows how admin authentication works. No route
 * handler and no service outside this file may read session headers or
 * resolve a user itself.
 *
 * Today: the shared admin identity in `src/models/admin/`. A session cookie
 * set by /admin/auth on admin.nachklang.art, plus a `tickets` permission on
 * the account. Both are re-checked on every request, so disabling a user or
 * taking their tickets permission away takes effect immediately.
 *
 * Before 2026-09-06 this was a header session against the calendar users
 * table, and any activated @nachklang.art account could administer vouchers
 * (see docs/plan-ticket-shop.md, which called a roles model out of scope for
 * v1). It is in scope now, and lives in the admin module rather than here.
 *
 * Explicitly forbidden: accepting session credentials from query parameters -
 * see DEFERRED_SECURITY.md item 1.
 */

export interface AdminIdentity {
	id: string;
	email: string;
	displayName: string;
}

// On failure: 401 when not signed in, 403 when signed in without the tickets
// permission.
export const requireAdminAuth = requireAppAccess('tickets');