import type { PermissionKey } from "@mrp/shared";
import type { NextFunction, Request, Response } from "express";

import { fail } from "./http.js";

export function requireAuth(request: Request, response: Response, next: NextFunction) {
  if (!request.authUser) {
    return fail(response, 401, "UNAUTHORIZED", "Authentication is required.");
  }

  next();
}

export function requirePermissions(requiredPermissions: PermissionKey[]) {
  return (request: Request, response: Response, next: NextFunction) => {
    if (!request.authUser) {
      return fail(response, 401, "UNAUTHORIZED", "Authentication is required.");
    }

    const available = new Set(request.authUser.permissions);
    const hasAll = requiredPermissions.every((permission) => available.has(permission));

    if (!hasAll) {
      return fail(response, 403, "FORBIDDEN", "You do not have access to this resource.");
    }

    next();
  };
}