/**
 * Restricts routes to company admin or super-admin.
 * HR-specific routes use `hrOrAdminMiddleware` instead (see backend/middleware/hrOrAdminMiddleware.js).
 */
const adminMiddleware = (req, res, next) => {
  const allowedRoles = ["admin", "super-admin"];
  
  if (!allowedRoles.includes(req.user.role)) {
    return res.status(403).json({ 
      message: "Access denied. Admin privileges required." 
    });
  }
  next();
};

module.exports = adminMiddleware;
