const requireAuth = (req, res, next) => {
  if (req.session && req.session.userId) {
    next();
  } else {
    return res.status(401).json({ message: 'Unauthorized. Please login.' });
  }
};

const requireRole = (role) => (req, res, next) => {
  if (req.session && req.session.role === role) {
    return next();
  }
  return res.status(403).json({ message: 'Forbidden. Insufficient permissions.' });
};

module.exports = { requireAuth, requireRole };
