<?php

namespace app\admin\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;

class PermissionCheck implements MiddlewareInterface
{
    public function process(Request $request, callable $handler): Response
    {
        $user = $request->user();
        $route = $request->route;

        // 检查角色
        $roles = $route->param('roles');
        if ($roles && !$user->roles()->whereIn('name', (array)$roles)->exists()) {
            return json(['code' => 403, 'msg' => '需要特定角色才能访问']);
        }

        // 检查权限
        $permission = $route->param('permission');
        if ($permission && !$user->hasPermission($permission)) {
            return json(['code' => 403, 'msg' => '无权访问']);
        }

        return $handler($request);
    }
}