const axios = require("axios");

module.exports = async function geoBlocker(req, res, next) {
  const ip = req.headers["x-forwarded-for"]?.split(",")[0] || req.socket.remoteAddress;

  try {
    const { data } = await axios.get(`http://ip-api.com/json/${ip}`);
    const country = data.countryCode;

    if (country !== "DE") {
      console.warn(`❌ Blocked visitor from ${country} (${ip})`);
      //return res.status(403).send("Zugriff verweigert – nur aus Deutschland erlaubt.");
    }

    next();
  } catch (err) {
    console.error("🌐 Geo-IP Fehler:", err.message);
    res.status(500).send("Geo-IP Service nicht erreichbar.");
  }
};