<?php
namespace app\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;
use app\service\AuthService;

class PermissionMiddleware implements MiddlewareInterface
{
    protected $permission_code;

    // 支持传参（如 "user:view"），可以在路由闭包里传入
    public function __construct($permission_code = null)
    {
        $this->permission_code = $permission_code;
    }

    public function process(Request $request, callable $next): Response
    {
        // 假设有 auth() helper 方法能获取当前登录用户ID
        $user_id = $request->session()->get('user_id');
        if (!$user_id) {
            return json(['code' => 401, 'msg' => '未登录']);
        }

        if ($this->permission_code && !AuthService::check($user_id, $this->permission_code)) {
            return json(['code' => 403, 'msg' => '没有权限']);
        }

        return $next($request);
    }
}