Gate setup and admin navigation

src/lib/session.ts

@@ -1,5 +1,6 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { cookies } from "next/headers";
+import { redirect } from "next/navigation";
 import { prisma } from "./prisma";
 
 const COOKIE_NAME = "watchlink_session";
@@ -49,3 +50,15 @@ export async function getCurrentUser() {
     include: { roles: { include: { role: true } } }
   });
 }
+
+export function userIsAdmin(user: Awaited<ReturnType<typeof getCurrentUser>>) {
+  return Boolean(user?.roles.some((userRole) => userRole.role.name === "admin"));
+}
+
+export async function requireCurrentUser() {
+  const user = await getCurrentUser();
+  if (!user) {
+    redirect("/login");
+  }
+  return user;
+}

src/lib/setup.ts

@@ -0,0 +1,20 @@
+import { redirect } from "next/navigation";
+import { prisma } from "./prisma";
+
+export async function hasAdminUser() {
+  try {
+    const admin = await prisma.userRole.findFirst({
+      where: { role: { name: "admin" } },
+      select: { userId: true }
+    });
+    return Boolean(admin);
+  } catch {
+    return false;
+  }
+}
+
+export async function requireInitialSetup() {
+  if (!(await hasAdminUser())) {
+    redirect("/setup");
+  }
+}