const jwt=require('jsonwebtoken');
function authenticateAdmin(req,res,next){
    const authHeader=req.headers.authorization;

    if(!authHeader || !authHeader.startsWith('Bearer ')){
        return res.json({message:'Missing or invalid token'});
    }
    const token=authHeader.split(' ')[1];
    try{
        const decoded=jwt.verify(token,process.env.JWT_SECRET);
        if(decoded.role !== 'admin'){
            return res.json({message:'Access denied. Admin only'});
        }
        req.user=decoded;
        next();
    }
    catch(err){
        return res.json({message:'Invalid or expired token'});
    }
}
module.exports=authenticateAdmin;