import { ExpressController, UnauthorizedApiError } from "@erp/core/api";
import { NextFunction, Response } from "express";
import { RequestWithAuth } from "./auth-types";

/**
 * Middleware que exige presencia de usuario (sin validar companyId).
 * Debe ir DESPUÉS del middleware de autenticación.
 */
export function enforceUser() {
  return (req: RequestWithAuth, res: Response, next: NextFunction) => {
    if (!req.user) {
      return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
    }
    next();
  };
}
