/**
 * Middleware to require a specific role for an endpoint.
 * @param {string[]} allowedRoles - Array of roles allowed to access the endpoint.
 * @returns {function} Express middleware function.
 */
export default function requireRole(allowedRoles) {
  return (req, res, next) => {
    const userRole = req.user?.role;
    
    if (!userRole) {
      return res.status(401).json({ error: 'Authorization required' });
    }
    
    if (!allowedRoles.includes(userRole)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    
    next();
  };
}

/**
 * Helper function to check if a user has a specific role.
 * @param {string} userRole - The role of the user.
 * @param {string[]} requiredRoles - Array of roles required.
 * @returns {boolean} True if the user has at least one of the required roles.
 */
export function hasRole(userRole, requiredRoles) {
  return requiredRoles.includes(userRole);
}