import { env } from "cloudflare:workers";

export function isAdminEmail(input: string | null | undefined) {
  const allowedEmail = String(
    (env as unknown as { ADMIN_ALLOWED_EMAIL?: string }).ADMIN_ALLOWED_EMAIL ??
      "",
  )
    .trim()
    .toLowerCase();
  const requestEmail = String(input ?? "").trim().toLowerCase();
  return Boolean(allowedEmail && requestEmail && requestEmail === allowedEmail);
}

export function isAdminRequest(request: Request) {
  if (isAdminEmail(request.headers.get("oai-authenticated-user-email"))) {
    return true;
  }
  const expectedToken = String(
    (env as unknown as { ADMIN_INTERNAL_TOKEN?: string }).ADMIN_INTERNAL_TOKEN ??
      "",
  ).trim();
  const requestToken = String(
    request.headers.get("x-koc-admin-token") ?? "",
  ).trim();
  return Boolean(
    expectedToken &&
      requestToken &&
      expectedToken.length === requestToken.length &&
      expectedToken === requestToken,
  );
}

export function adminForbidden() {
  return Response.json({ error: "无后台操作权限" }, { status: 403 });
}