import "server-only";
import { getSession } from "./auth";

/**
 * Belt and braces for main-app write routes: the proxy already keeps Office, Mechanic and
 * Clock-in users out of every non-clock path, but a destructive route should not depend on that
 * alone. Returns a Response to send back when the caller is not a Full user, otherwise null.
 */
export async function refuseUnlessFull(): Promise<Response | null> {
  const session = await getSession();
  if (!session) return Response.json({ ok: false, error: "Please sign in." }, { status: 401 });
  if (session.access !== "full") return Response.json({ ok: false, error: "Only full users can do this." }, { status: 403 });
  return null;
}