defmodule Localiser.Web.Plugs.BootstrapGuard do
  @moduledoc "Halts with 403 if any users already exist - protects POST /api/setup."
  import Plug.Conn

  alias Localiser.Domain.Users

  def init(opts), do: opts

  def call(conn, _opts) do
    if Users.any?() do
      conn
      |> put_resp_content_type("application/json")
      |> send_resp(403, ~s({"error":"system already initialised"}))
      |> halt()
    else
      conn
    end
  end
end