const { hasPermission } = require('../constants/permissions')
const { authenticateRequest } = require('./session')

function requirePermission(...required) {
  return async (req, res, next) => {
    try {
      const account = await authenticateRequest(req)
      if (!hasPermission(account, required)) {
        const error = new Error('没有操作权限')
        error.status = 403
        throw error
      }
      req.operator = account
      next()
    } catch (error) {
      next(error)
    }
  }
}

module.exports = { requirePermission }