route-commerce/src/lib/auth-guards.ts

import { getAdminUser } from "@/lib/admin-permissions";
import type { AdminUser } from "@/lib/admin-permissions-types";

export type AuthGuardResult =
  | { authorized: true; adminUser: AdminUser }
  | { authorized: false; adminUser: null };

/**
 * Require an authenticated admin user. Returns a discriminated result so
 * callers can branch without throwing. Use this in API route handlers that
 * need a uniform "is this request authenticated?" check before proceeding.
 */
export async function requireAdminUser(): Promise<AuthGuardResult> {
  const adminUser = await getAdminUser();
  if (!adminUser) {
    return { authorized: false, adminUser: null };
  }
  return { authorized: true, adminUser };
}