/**
 * Allows HR, company admin, or super-admin (HR-related / company-wide operations).
 */
const hrOrAdminMiddleware = (req, res, next) => {
  const allowed = ["hr", "admin", "super-admin"];
  if (!allowed.includes(req.user?.role)) {
    return res.status(403).json({
      message: "Access denied. HR or admin privileges required.",
    });
  }
  next();
};

module.exports = hrOrAdminMiddleware;
