"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.authorizeRoles = void 0;
const response_utils_1 = require("../utils/response.utils");
const authorizeRoles = (...allowedRoles) => {
    return (req, res, next) => {
        if (!req.user) {
            (0, response_utils_1.sendError)(res, 'Unauthorized access', 401);
            return;
        }
        if (!allowedRoles.includes(req.user.role)) {
            (0, response_utils_1.sendError)(res, `Access denied. Required role: [${allowedRoles.join(', ')}]. Current role: ${req.user.role}`, 403);
            return;
        }
        next();
    };
};
exports.authorizeRoles = authorizeRoles;
//# sourceMappingURL=rbac.middleware.js.map