const { readEmails } = require('./allowlistStore');

function createAllowlistMiddleware(filePath) {
  return function allowlistMiddleware(req, res, next) {
    const email = (req.headers['x-auth-request-email'] || '').toLowerCase();
    const allowed = readEmails(filePath);
    if (!email || !allowed.includes(email)) {
      res.status(403).send('Forbidden');
      return;
    }
    next();
  };
}

module.exports = { createAllowlistMiddleware };