/**
 * Authentication middleware.
 *
 * When AUTH_ENABLED=true in the environment, every protected route requires
 * an active session (set by POST /api/v1/auth/login).
 *
 * When AUTH_ENABLED is unset or any other value, the middleware is a no-op
 * so the stack can be deployed and tested without setting up users first.
 * Set AUTH_ENABLED=true in production after running POST /api/v1/auth/setup
 * to create the first admin account.
 */
export const requireAuth = (req, res, next) => {
  if (process.env.AUTH_ENABLED !== 'true') return next();
  if (!req.session || !req.session.userId) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
};