RBAC model:

  User  → assigned one or more Roles
  Role  → grants a set of Permissions (or is just a label you check)
  Permission → a specific allowed action (e.g. "posts:delete", "users:manage")

Flat RBAC (common for small apps):
  role: 'admin' | 'editor' | 'user'
  → if (user.role === 'admin') allow

Permission-based (scales better):
  user.permissions = ['posts:read', 'posts:write']
  → if (user.permissions.includes('posts:delete')) allow

// Call AFTER authenticate middleware — req.user must already be set:
export function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) return res.status(401).json({ error: 'Not authenticated' })
    if (!roles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Forbidden' })
    }
    next()
  }
}

// Usage:
app.delete('/users/:id',
  authenticate,                     // who are you?
  requireRole('admin'),             // may you do this?
  deleteUserHandler,
)

app.put('/posts/:id',
  authenticate,
  requireRole('admin', 'editor'),   // either role is allowed
  updatePostHandler,
)

// A user can edit THEIR OWN posts; admins can edit any post:
app.put('/posts/:id', authenticate, async (req, res) => {
  const post = await db.posts.findById(req.params.id)
  if (!post) return res.status(404).json({ error: 'Not found' })

  const isOwner = post.authorId === req.user.id
  const isAdmin = req.user.role === 'admin'

  if (!isOwner && !isAdmin) {
    return res.status(403).json({ error: 'Forbidden' })
  }

  const updated = await db.posts.update(req.params.id, req.body)
  res.json(updated)
})