defmodule ShootingEventPhxWeb.Plugs.AdminOnly do
  @moduledoc false
  import Plug.Conn
  alias ShootingEventPhx.Auth

  def init(opts), do: opts

  def call(conn, _opts) do
    if Auth.admin_request?(conn) do
      conn
    else
      conn
      |> put_status(:unauthorized)
      |> Phoenix.Controller.json(%{"message" => "invalid or expired admin token"})
      |> halt()
    end
  end
end