// /middlewares/permissionMiddleware.js

const AppError = require('../utils/AppError');

const requirePermission = (requiredPermission) => {
  const perms = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
  return (req, res, next) => {
    try {
      if (!req.user) {
        return next(new AppError('UNAUTHORIZED'));
      }

      const role = req.user.role;
      if (!role) {
        return next(new AppError('FORBIDDEN'));
      }

      const roleName = String(role.name || '').toLowerCase();
      if (roleName === 'superadmin' || (role.isSystem && role.permissions.includes('*'))) {
        return next();
      }

      // Check if any required permission is held by role
      if (Array.isArray(role.permissions) && perms.some((p) => role.permissions.includes(p))) {
        return next();
      }

      return next(new AppError('FORBIDDEN'));
    } catch (error) {
      next(error);
    }
  };
};

module.exports = requirePermission;
module.exports.requires = requirePermission;