import { redirect } from "next/navigation";
import { UserRole } from "@prisma/client";
import { requireKitaSession } from "@/lib/auth-utils";
import { prisma } from "@/lib/prisma";
import type { StaffActor } from "./service";

export async function requireStaffActor(): Promise<StaffActor> {
  const { user } = await requireKitaSession();
  const current = await prisma.user.findFirst({
    where: { id: user.id, kitaId: user.kitaId },
    select: {
      id: true,
      kitaId: true,
      role: true,
      lockedUntil: true,
      disabledAt: true,
      emailVerifiedAt: true,
      privacyPolicyAcceptedAt: true,
    },
  });
  if (
    !current?.kitaId ||
    !current.privacyPolicyAcceptedAt ||
    !!current.disabledAt || !current.emailVerifiedAt ||
    current.role !== user.role ||
    (current.role !== UserRole.ADMIN && current.role !== UserRole.ERZIEHER) ||
    (current.lockedUntil && current.lockedUntil > new Date())
  )
    redirect("/forbidden");
  return { id: current.id, kitaId: current.kitaId, role: current.role };
}