/**
 * HR role: access only HR-related routes (leave approval, company attendance, etc.).
 * Super-admin and admin keep full access.
 * Use together with authMiddleware.
 */
const hrResourceMiddleware = (req, res, next) => {
  const allowed = ["hr", "admin", "super-admin"];
  if (!allowed.includes(req.user?.role)) {
    return res.status(403).json({
      message: "Access denied. HR or administrator privileges required.",
    });
  }
  next();
};

module.exports = hrResourceMiddleware;
