/**
 * Role guard. Use after `authenticate`. Steps 5–7 attach this to the routes
 * that only a superadmin may call (e.g. admin-user management).
 */
import type { NextFunction, Request, RequestHandler, Response } from 'express';
import { AppError } from '../lib/AppError';

type Role = 'superadmin' | 'admin';

export function requireRole(...roles: Role[]): RequestHandler {
  return (req: Request, _res: Response, next: NextFunction): void => {
    if (req.admin && roles.includes(req.admin.role)) {
      next();
      return;
    }
    next(AppError.forbidden());
  };
}