src/lib/server/auth/guards.ts

import { error } from '@sveltejs/kit';
import type { User } from '../../domain/types';
import { UsersRepo, UserValidationError } from '../users/repository';

/** Every admin load/action calls this; the route gate in hooks is defense in depth, not the check. */
export function requireAdmin(locals: App.Locals): User {
	const user = locals.user;
	if (!user || user.role !== 'admin') error(403, 'Admins only');
	return user;
}

/** Admin mutations may only target members: the admin's own account is managed via /me. */
export function requireMemberTarget(users: UsersRepo, id: string): User {
	const user = users.byId(id);
	if (!user || user.role !== 'member') throw new UserValidationError('Unknown user', 'id');
	return user;
}