// src/middleware/requireAdmin.js
const IDLE_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes of inactivity signs the admin out

function requireAdmin(req, res, next) {
  if (!req.session || !req.session.adminId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  const now = Date.now();
  if (req.session.lastActivity && now - req.session.lastActivity > IDLE_TIMEOUT_MS) {
    return req.session.destroy(() => res.status(401).json({ error: 'Session expired due to inactivity. Please sign in again.' }));
  }
  req.session.lastActivity = now;
  return next();
}

module.exports = requireAdmin;
