import type { IdentityUser } from "@/modules/identity/contracts";

export type AdminRole = "admin";

export type AdminAccessResult =
  | { allowed: true; role: AdminRole }
  | { allowed: false; status: 401 | 403 };

export function authorizeAdminAccess(
  user: IdentityUser | null,
  access: "read" | "write",
): AdminAccessResult {
  if (!user) return { allowed: false, status: 401 };
  if (!user.role.includes("admin")) {
    return { allowed: false, status: 403 };
  }
  return { allowed: true, role: "admin" };
}