module.exports = {
  // Require authenticated user
  isAuthenticated: (req, res, next) => {
    if (!req.session.user) {
      req.flash('error', 'Please log in to continue.');
      return res.redirect('/login');
    }
    next();
  },

  // Require admin role
  isAdmin: (req, res, next) => {
    if (!req.session.user || !req.session.user.isAdmin) {
      req.flash('error', 'Access denied. Admin only.');
      return res.redirect('/');
    }
    next();
  },

  // Redirect if already logged in
  isGuest: (req, res, next) => {
    if (req.session.user) {
      return res.redirect('/');
    }
    next();
  },
};
