<?php
// ============================================================
// backend/middleware/auth.php
// ============================================================

function requireAuth(): array {
    $token = getBearerToken();
    if (!$token) sendError('Unauthorized: no token provided', 401);

    $payload = verifyJWT($token);
    if (!$payload) sendError('Unauthorized: invalid or expired token', 401);

    return $payload; // returns ['id', 'email', 'role', ...]
}

function requireAdmin(): array {
    $user = requireAuth();
    if ($user['role'] !== 'admin') sendError('Forbidden: admin access required', 403);
    return $user;
}
