function requirePermission(permission, ws, next) {
    if (!ws.user) {
        return ws.send(JSON.stringify({ error: "Unauthorized" }));
    }
    if (!ws.user.possibilities[permission]) {
        return ws.send(JSON.stringify({ error: `Forbidden: missing ${permission}` }));
    }
    next();
}

module.exports = { requirePermission };