/**
 * Authentication Middleware Additions Required
 * 
 * Add this middleware to backend/src/middleware/auth.js
 */

// Add this function to your existing auth.js file:

/**
 * Middleware to require system admin privileges
 * Use in routes that only system admins should access
 */
const requireSystemAdmin = (req, res, next) => {
  // First check if user is authenticated
  if (!req.user) {
    return res.status(401).json({ 
      success: false, 
      error: 'Authentication required' 
    });
  }

  // Then check if user is a system admin
  if (!req.user.is_system_admin) {
    return res.status(403).json({
      success: false,
      error: 'System admin privileges required',
      message: 'This action requires system administrator access'
    });
  }

  // User is authenticated and is a system admin
  next();
};

// Add to exports:
module.exports = {
  authenticate,           // existing middleware
  requireSystemAdmin,     // NEW middleware for system admin routes
  // ... other middleware
};

/**
 * Usage in routes:
 * 
 * const { authenticate, requireSystemAdmin } = require('../../middleware/auth');
 * 
 * router.post('/ban-account', authenticate, requireSystemAdmin, controller.banAccount);
 * router.get('/admins', authenticate, requireSystemAdmin, controller.getSystemAdmins);
 */

/**
 * Middleware Chain Order:
 * 
 * 1. authenticate - Validates JWT token and attaches user to request
 * 2. requireSystemAdmin - Verifies is_system_admin = TRUE
 * 3. Controller handler
 */