"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.requireAdmin = requireAdmin;
exports.requireProjectOwner = requireProjectOwner;
const config_1 = require("../config");
/**
 * Require admin. Use after `authMiddleware`.
 * Fails closed (403) when req.user is missing or not admin.
 */
function requireAdmin(req, res, next) {
    if (!(0, config_1.isAdminUser)(req.user?.username)) {
        res.status(403).json({ error: 'Admin only' });
        return;
    }
    next();
}
/**
 * Require owner (or admin) of the project identified by the given route param.
 * Use after `authMiddleware`. 404 when project not found, 403 when not owner.
 */
function requireProjectOwner(paramName = 'projectId') {
    return (req, res, next) => {
        const id = req.params[paramName];
        if (!id) {
            res.status(400).json({ error: `Missing param: ${paramName}` });
            return;
        }
        const project = (0, config_1.getProject)(id);
        if (!project) {
            res.status(404).json({ error: 'Project not found' });
            return;
        }
        if (!(0, config_1.isProjectOwner)(project, req.user?.username)) {
            res.status(403).json({ error: 'Forbidden' });
            return;
        }
        next();
    };
}
//# sourceMappingURL=authz.js.map