<?php

namespace App\Http\Middleware;

use App\Core\Request;
use App\Core\Response;
use App\Domain\Services\RbacService;
use App\Exceptions\AuthException;

class RoleMiddleware
{
    public function __construct(private RbacService $rbac)
    {
    }

    public function handle(Request $request, callable $next, string $permission = 'auth:*'): Response
    {
        if (!$this->rbac->can((int)$request->attribute('role_id'), $permission)) {
            throw new AuthException('Forbidden', 403);
        }

        return $next($request);
    }
}
