import { Request, Response, NextFunction } from 'express';
import Config from '#config';

export function requireAdminApiKey(req: Request, res: Response, next: NextFunction): void {
	const apiKey = req.header('X-Admin-Api-Key') || req.query.admin_api_key as string | undefined;
	const expectedKey = process.env.ADMIN_API_KEY || Config.server.backendUrl; // fallback

	if (!apiKey || apiKey !== expectedKey) {
		res.status(401).json({ error: 'Unauthorized', message: 'Invalid or missing admin API key' });
		return;
	}

	next();
}
