35 lines
934 B
PHP
35 lines
934 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Middlewares;
|
|
|
|
use Core\Middleware;
|
|
use Core\Request;
|
|
use Core\Response;
|
|
use Core\Database;
|
|
use PDO;
|
|
|
|
class AdminMiddleware extends Middleware
|
|
{
|
|
public function handle(Request $request, callable $next): void
|
|
{
|
|
$userId = $request->getHeader('x-user-id');
|
|
|
|
try {
|
|
$pdo = Database::getConnection();
|
|
$stmt = $pdo->prepare('SELECT role FROM users WHERE id = :user_id LIMIT 1');
|
|
$stmt->execute([':user_id' => $userId]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user || !in_array($user['role'], ['ADMIN', 'SUPER_ADMIN'], true)) {
|
|
Response::forbidden('Administrative privileges required to access this resource.');
|
|
}
|
|
} catch (\Throwable $e) {
|
|
Response::error('Role verification failure: ' . $e->getMessage(), 500);
|
|
}
|
|
|
|
$next($request);
|
|
}
|
|
}
|