// Auth middleware: requireLogin gates API routes, requireAdmin restricts admin actions.

function requireLogin(req, res, next) {
    if (req.session && req.session.userId) {
        return next();
    }
    return res.status(401).json({ error: 'Nicht angemeldet' });
}

function requireAdmin(req, res, next) {
    if (req.session && req.session.userId && req.session.isAdmin) {
        return next();
    }
    return res.status(403).json({ error: 'Admin-Rechte erforderlich' });
}

module.exports = { requireLogin, requireAdmin };