/**
 * Admin Authentication Middleware
 * Validates server-side session for admin users
 */

const requireAdminAuth = (req, res, next) => {
    const sessionUser = req.session && req.session.user;

    if (!sessionUser || sessionUser.role !== 'admin') {
        return res.status(403).json({
            error: 'Zugriff verweigert',
            reason: 'SESSION_REQUIRED'
        });
    }

    res.locals.adminUser = sessionUser;
    next();
};

module.exports = { requireAdminAuth };
