import 'server-only'
import { hasListScopes } from './oauth'

/**
 * Gate for API routes that write app.bsky.graph.list / listitem / listblock
 * records. Returns a structured 403 when the session's OAuth grant lacks the
 * list scopes, or null when the request may proceed.
 *
 * The frontend detects `error === 'insufficient_scope'` (never error text)
 * and offers the /api/oauth/upgrade redirect.
 */
export async function requireListScopes(did: string): Promise<Response | null> {
  if (await hasListScopes(did)) return null
  return Response.json(
    { error: 'insufficient_scope', required: 'lists' },
    { status: 403 }
  )
}