wing-ops/backend/src/auth/authMiddleware.ts

import type { Request, Response, NextFunction } from 'express'
import { verifyToken, getTokenFromCookie } from './jwtProvider.js'
import type { JwtPayload } from './jwtProvider.js'

declare global {
  namespace Express {
    interface Request {
      user?: JwtPayload
    }
  }
}

export function requireAuth(req: Request, res: Response, next: NextFunction): void {
  const token = getTokenFromCookie(req.cookies || {})

  if (!token) {
    res.status(401).json({ error: '인증이 필요합니다.' })
    return
  }

  try {
    const payload = verifyToken(token)
    req.user = payload
    next()
  } catch {
    res.status(401).json({ error: '인증 토큰이 유효하지 않습니다.' })
  }
}

export function requireRole(...roles: string[]) {
  return (req: Request, res: Response, next: NextFunction): void => {
    if (!req.user) {
      res.status(401).json({ error: '인증이 필요합니다.' })
      return
    }

    const hasRole = req.user.roles.some((r) => roles.includes(r))
    if (!hasRole) {
      res.status(403).json({ error: '접근 권한이 없습니다.' })
      return
    }

    next()
  }
}