feat(POS-002): completed feature

project/src/shared/auth.ts

@@ -6,7 +6,7 @@
 import type { FastifyRequest } from 'fastify';
 import { AppError } from './errors.js';
 
-export type Role = 'customer' | 'admin' | 'editor';
+export type Role = 'customer' | 'admin' | 'editor' | 'pos_cashier' | 'pos_manager';
 
 export interface CurrentUser {
   id: string;
@@ -27,6 +27,15 @@ export function requireRole(user: CurrentUser, role: Role): void {
   }
 }
 
+/** Throws AppError(403) unless the user holds at least one of the allowed roles.
+ *  Use when an endpoint accepts multiple roles (e.g. POS-002 endpoints accept
+ *  `pos_cashier`, `pos_manager`, and `admin`). */
+export function requireAnyRole(user: CurrentUser, roles: ReadonlyArray<Role>): void {
+  if (!roles.includes(user.role)) {
+    throw new AppError(403, 'FORBIDDEN', 'Access denied');
+  }
+}
+
 /** Throws AppError(403) unless the user is the resource owner or an admin. */
 export function requireOwnerOrAdmin(user: CurrentUser, ownerId: string): void {
   if (user.role !== 'admin' && user.id !== ownerId) {