package access

import (
	"context"
	"fmt"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/coredb"
	"github.com/tidbcloud/AgentTeam/internal/store/storeerr"
)

// RequireSystemAdminUser verifies that userID belongs to a system admin user.
func RequireSystemAdminUser(ctx context.Context, queryer coredb.QueryRower, userID string) error {
	row := queryer.QueryRow(ctx, `
SELECT is_admin
FROM users
WHERE id = $1
`, strings.TrimSpace(userID))

	var isAdmin bool
	if err := row.Scan(&isAdmin); err != nil {
		if coredb.IsNotFound(err) {
			return storeerr.ErrUnauthorized
		}
		return fmt.Errorf("load system admin user: %w", err)
	}
	if !isAdmin {
		return storeerr.ErrForbidden
	}
	return nil
}