<?php
declare(strict_types=1);

namespace App\Middleware;

use Core\Middleware;
use Core\Session;

/**
 * Require a SuperAdmin session. Does NOT run TenantScope — SuperAdmins
 * have no tenant by default but may have an impersonation override.
 */
final class SuperAuth implements Middleware
{
    public function handle(array $context): void
    {
        if (!Session::check()) {
            Session::flash('super_msg', 'Please sign in.');
            redirect('/SuperLogin');
        }

        $user = Session::user();
        if (empty($user['is_super_admin'])) {
            Session::flash('super_msg', 'SuperAdmin access required.');
            redirect('/SuperLogin');
        }
    }
}