import { NextResponse } from "next/server";
import { getCurrentUser, type RequestLike } from "@/lib/auth/session";
import { isProActive } from "@/lib/billing/access";

/**
 * Export endpoints generate files from caller-supplied receipt JSON.
 * Require a signed-in Pro session so CSRF-only callers cannot burn compute
 * or bypass the paywall.
 */
export async function requireProExporter(request?: RequestLike): Promise<
  { ok: true } | { ok: false; response: NextResponse }
> {
  const user = await getCurrentUser(request);
  if (!user) {
    return {
      ok: false,
      response: NextResponse.json({ error: "unauthorized" }, { status: 401 }),
    };
  }
  if (!isProActive(user)) {
    return {
      ok: false,
      response: NextResponse.json({ error: "pro_required" }, { status: 403 }),
    };
  }
  return { ok: true };
}
