import allowedSubmitters from "./allowedSubmitters.json";

// Ported from the legacy Eventer app's allowedUsers.json + WatIAM-based
// check (src/server.ts). That app gated the whole form behind an ADFS
// header; here there's no ADFS header (the caller is a backend, not a
// browser), so the equivalent identity is the WatIAM quest ID implied by
// submittedByEmail's local part (everything before @uwaterloo.ca).
//
// This is a *submitter* allowlist -- distinct from UPSTREAM_API_SECRET
// (auth.ts), which authenticates the calling service, not the individual
// on whose behalf it's calling. Both checks apply independently.
export function isAllowedSubmitter(submittedByEmail: string): boolean {
  const questId = submittedByEmail.split("@")[0].toLowerCase();
  return allowedSubmitters.some((allowed) => allowed.trim().toLowerCase() === questId);
}