const token = await generateToken(
  user.id,
  user.username,
  env.JWT_SECRET,
  roles
)

const token = getAuthToken(request)
const payload = await verifyToken(token, env.JWT_SECRET)
const userId = payload.userId

async function hasPermission(
  userId: number,
  permission: string,
  env: Env
): Promise<boolean> {
  const roles = await getUserRoles(userId, env)
  if (roles.includes('admin')) return true
  
  const permissions = await getUserPermissions(userId, env)
  return permissions.includes('*') || permissions.includes(permission)
}