const pool = require('../db');

async function requireCurator(req, res, next) {
  const userId = req.session?.userId;
  if (!userId) {
    return res.status(401).json({ error: 'Curator login required' });
  }

  try {
    const { rows } = await pool.query(
      `SELECT id, username FROM users WHERE id = $1`,
      [userId]
    );
    if (rows.length === 0) {
      req.session.destroy(() => {});
      return res.status(401).json({ error: 'Curator login required' });
    }

    req.curatorUser = rows[0];
    next();
  } catch (err) {
    console.error('Auth middleware error:', err.message);
    res.status(500).json({ error: 'Authentication failed' });
  }
}

module.exports = { requireCurator };