import { getServerSession } from "next-auth";
import { redirect } from "next/navigation";
import { authOptions } from "@/lib/auth/auth-options";
import { requireActiveSuperAdmin } from "@/lib/auth/verify-session-user";
import { loginRedirectUrl } from "@/lib/auth/post-auth-path";

/** Require super_admin role — always verified against DB, not stale JWT. */
export async function requireSuperAdmin() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.id) {
    redirect(loginRedirectUrl("SessionRequired"));
  }

  const dbUser = await requireActiveSuperAdmin(session.user.id);
  if (!dbUser) {
    redirect("/app/dashboard");
  }

  return {
    session,
    userId: dbUser.id,
    userName: dbUser.name ?? "Admin",
  };
}