// src/middleware/checkRole.js
const HttpException = require("../utils/HttpException");

const checkRole = (requiredRoles = []) => {
    return (req, res, next) => {
        const userRoles = req.user?.roles || [];

        const hasRole = requiredRoles.some(role => userRoles.includes(role));

        if (!hasRole) {
            throw new HttpException("You don't have permission to access this resource.", 403);
        }

        next();
    };
};

module.exports = checkRole;
