import { error } from "@/lib/response";
import type { Context, Next } from "hono";

// Sensitive member actions (credential resets, Viewpoint profile syncs, booking
// data) are super-admin only. Chain this AFTER withConsoleUserSession(), which
// is what sets `isAdminConsoleSuperAdmin`.
export const withSuperAdmin = () => async (ctx: Context, next: Next) => {
  if (!ctx.get("isAdminConsoleSuperAdmin")) {
    return error(ctx, "This action is restricted to super admins", 403);
  }
  await next();
};