package middleware

import (
	"crypto/subtle"
	"encoding/json"
	"net/http"
)

func AdminAuth(apiKey string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			provided := r.Header.Get("X-API-Key")
			if provided == "" || subtle.ConstantTimeCompare([]byte(provided), []byte(apiKey)) != 1 {
				w.Header().Set("Content-Type", "application/json")
				w.WriteHeader(http.StatusUnauthorized)
				_ = json.NewEncoder(w).Encode(map[string]string{
					"error":  "Unauthorized",
					"detail": "missing or invalid X-API-Key",
				})
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}