/**
* Shared auth helpers for route handlers.
*/
import { UnauthorizedError, ForbiddenError } from '../errors.js'
/**
* Auth helper — authenticate + check permission, throw on failure.
* @param {Object} req - HTTP request
* @param {Object} server - HypernoteServer instance
* @param {string} action - 'read', 'write', or 'admin'
* @param {string} [notebook] - Notebook slug (optional)
* @returns {Promise<Object>} Auth result
*/
export async function requireAuth (req, server, action, notebook) {
const { authorized, auth, reason } = await server.authManager.authorizeRequest(req, action, notebook)
if (!auth) throw new UnauthorizedError('Authentication required')
if (!authorized) throw new ForbiddenError(reason, action)
return auth
}