import { NextRequest } from "next/server";

/**
 * Device-scoped secret, distinct from AGENT_API_KEY — a POS device
 * only needs checkout/catalog/sales access, not the full agent API
 * surface, so it gets its own key rather than reusing the agent's.
 */
export function assertPosAuth(req: NextRequest) {
  const expected = process.env.POS_API_KEY;
  if (!expected) {
    throw new Error("POS_API_KEY is not configured.");
  }

  const authHeader = req.headers.get("authorization") || "";
  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";

  if (token !== expected) {
    const error = new Error("Unauthorized");
    (error as Error & { status?: number }).status = 401;
    throw error;
  }
}