import { Request, Response, NextFunction } from 'express';

export type AccessRule = { role: string; product?: string };

export function requireAccess( rules: AccessRule[] )
{
  return ( req: Request, res: Response, next: NextFunction ): void =>
  {
    const auth = req.auth;
    if ( !auth ) { res.status( 401 ).json( { error: 'Not authenticated' } ); return; }

    if ( auth.roles.includes( 'superadmin' ) ) { next(); return; }

    const allowed = rules.some( rule =>
      auth.roles.includes( rule.role ) &&
      ( !rule.product || auth.products.includes( rule.product ) )
    );

    if ( allowed ) { next(); return; }
    res.status( 403 ).json( { error: 'Forbidden' } );
  };
}