package game

import "thehouseoficarus/internal/net"

// checkAdmin reports whether the session belongs to an account with the
// on-disk admin flag set. The cached sess.Account copy is only refreshed on
// login or account republish, so it is NOT trusted as the source of truth:
// removing admin: true from an account file (or the admin API's reload) must
// demote an already-connected admin without requiring a relog. The account
// file is re-read on the owner goroutine, which serializes with logins and
// account saves, so the check cannot race a concurrent hash/admin change.
// Privilege checks fail closed when the account cannot be read.
func (g *Game) checkAdmin(sess *net.Session) bool {
	if sess.Account == nil {
		return false
	}
	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
	if err != nil || !acc.Admin {
		// Drop the stale cached privilege too, so command gating and any
		// code reading sess.Account.Admin agree with disk.
		sess.Account.Admin = false
		return false
	}
	return true
}