src/middleware/requireAdmin.js

export const requireAdmin = (req, res, next) => {
  if (!req.user || req.user.role !== 'admin') {
    return res.status(403).send({ error: 'Admin only' });
  }
  next();
};