gameno-api/middlewares/permissionMiddleware.js

// /middlewares/permissionMiddleware.js

const AppError = require('../utils/AppError');

const requirePermission = (requiredPermission) => {
  return (req, res, next) => {
    try {
      if (!req.user) {
        return next(new AppError('UNAUTHORIZED'));
      }

      const role = req.user.role;
      if (!role) {
        return next(new AppError('FORBIDDEN'));
      }

      // Check if user is superAdmin (by role name or system status)
      if (role.name === 'superAdmin' || (role.isSystem && role.permissions.includes('*'))) {
        return next();
      }

      // Check if required permission is held by role
      if (Array.isArray(role.permissions) && role.permissions.includes(requiredPermission)) {
        return next();
      }

      return next(new AppError('FORBIDDEN'));
    } catch (error) {
      next(error);
    }
  };
};

module.exports = requirePermission;
module.exports.requires = requirePermission;