import type { Request } from "firebase-functions/https";
import { auth } from "../firebase";
import { HttpError } from "./errors";

export async function requireAdmin(req: Request): Promise<string> {
  const header = req.get("authorization") ?? req.get("Authorization");
  if (!header || !header.startsWith("Bearer ")) {
    throw new HttpError(401, "Missing Bearer token");
  }
  const token = header.substring(7).trim();
  try {
    const decoded = await auth.verifyIdToken(token);
    if (decoded.admin !== true) {
      throw new HttpError(403, "admin claim required");
    }
    return decoded.uid;
  } catch (err) {
    if (err instanceof HttpError) throw err;
    throw new HttpError(401, "Invalid token");
  }
}