package httpapi

import (
	"net"
	"net/http"

	"github.com/gin-gonic/gin"
)

func loopbackAdminOnly() gin.HandlerFunc {
	return func(ctx *gin.Context) {
		host, _, err := net.SplitHostPort(ctx.Request.RemoteAddr)
		if err != nil {
			denyNonLocalAdmin(ctx)
			return
		}
		address := net.ParseIP(host)
		if address == nil || !address.IsLoopback() {
			denyNonLocalAdmin(ctx)
			return
		}
		ctx.Next()
	}
}

func denyNonLocalAdmin(ctx *gin.Context) {
	ctx.Header("Cache-Control", "no-store")
	ctx.AbortWithStatusJSON(
		http.StatusForbidden,
		errorResponse(
			ctx,
			"ADMIN_SESSION_REQUIRED",
			"admin session required",
		),
	)
}