import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import { and, eq, isNull } from "drizzle-orm";
import { authUsers } from "../../db/schema/auth_users";

export async function requireSystemAdmin(server: FastifyInstance, req: FastifyRequest, reply: FastifyReply) {
    if (!req.user?.user_id) {
        reply.code(401).send({ error: "Unauthorized" });
        return null;
    }
    // Read the current global role; tenant roles and stale JWT claims do not grant access.
    const [user] = await server.db.select({ id: authUsers.id, email: authUsers.email, is_admin: authUsers.is_admin })
        .from(authUsers).where(and(eq(authUsers.id, req.user.user_id), isNull(authUsers.archived_at))).limit(1);
    if (!user?.is_admin) {
        reply.code(403).send({ error: "Admin access required" });
        return null;
    }
    return user;
}