add first files

apps/api/src/middleware/requireRole.ts

@@ -0,0 +1,32 @@
+import { Request, Response, NextFunction } from 'express'
+import { EmployeeRole } from '@rentaldrivego/database'
+
+const ROLE_RANK: Record<EmployeeRole, number> = {
+  OWNER:   3,
+  MANAGER: 2,
+  AGENT:   1,
+}
+
+export function requireRole(minimumRole: EmployeeRole) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const employee = req.employee
+    if (!employee) {
+      return res.status(401).json({ error: 'unauthenticated', message: 'Authentication required', statusCode: 401 })
+    }
+
+    const employeeRank = ROLE_RANK[employee.role] ?? 0
+    const requiredRank = ROLE_RANK[minimumRole] ?? 99
+
+    if (employeeRank < requiredRank) {
+      return res.status(403).json({
+        error: 'forbidden',
+        message: `This action requires the ${minimumRole} role or higher`,
+        statusCode: 403,
+        requiredRole: minimumRole,
+        yourRole: employee.role,
+      })
+    }
+
+    next()
+  }
+}