import type { AuthUser } from "@tracker/shared";

import { HttpError } from "../../lib/http-error.js";
import { queryOne } from "../../lib/db.js";

export const assertVehicleAccess = async (user: AuthUser, vehicleId: string) => {
  if (user.role === "admin") {
    return;
  }

  const permission = await queryOne<{ user_id: string }>(
    `
      select user_id
      from user_vehicle_permissions
      where user_id = $1 and vehicle_id = $2
    `,
    [user.id, vehicleId],
  );

  if (!permission) {
    throw new HttpError(403, "Vehicle access denied");
  }
};