<?php

declare(strict_types=1);

namespace WorkforceOS\Middleware;

final class PermissionGuard
{
    public function assertCan(array $user, string $permission): void
    {
        $permissions = $user['permissions'] ?? [];
        if (!in_array($permission, $permissions, true)) {
            throw new \RuntimeException('Permission denied: ' . $permission);
        }
    }
}
