import type { Request, Response } from 'express';
import { resolveOmnlPrincipal } from '@dbis/integration-foundation';
import { loadConfig } from '../config';

export function requireApiKey(req: Request, res: Response): boolean {
  const cfg = loadConfig();
  if (!cfg.production.requireApiKey) return true;
  const principal = resolveOmnlPrincipal(req);
  if (!principal) {
    res.status(401).json({ error: 'Unauthorized' });
    return false;
  }
  if (principal.role === 'customer') {
    res.status(403).json({ error: 'Forbidden', hint: 'Settlement APIs require super-admin credentials' });
    return false;
  }
  return true;
}
