package middleware

import (
	"net/http"

	"github.com/gin-gonic/gin"
	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
)

// RequireRoleKey adds defense in depth for administrator-only operations.
// Casbin remains the primary API permission layer; this guard prevents a
// future policy/configuration mistake from widening a sensitive operation.
func RequireRoleKey(roleKey string) gin.HandlerFunc {
	return func(c *gin.Context) {
		role, _ := jwt.ExtractClaims(c)["rolekey"].(string)
		if role != roleKey {
			c.JSON(http.StatusForbidden, gin.H{
				"code":    "FORBIDDEN",
				"message": "只有管理员可以执行此操作",
			})
			c.Abort()
			return
		}
		c.Next()
	}
}