
const User = require('../models/User');

exports.protect = async (req, res, next) => {
  try {
    if (!req.session || !req.session.userId) {
      return res.status(401).json({ message: 'Not authorized' });
    }

    const user = await User.findById(req.session.userId).select('-password');

    if (!user) {
      return res.status(401).json({ message: 'Not authorized' });
    } 

    req.user = user;
    next();
  } catch (err) {
    return res.status(401).json({ message: 'Not authorized' });
  }
};

exports.admin = (req, res, next) => {
  if (!req.user || req.user.role !== 'admin') {
    return res.status(403).json({ message: 'Admin access required' });
  }
  next();
};
