如何限制Express API的访问权限？

Question

I am looking for general idea on how to limit access to the api. I have authentication implemented and some resources are locked to authenticated users. But how do i make authorization and grant specific app permissions, so each user in that app can have different permissions?

ie

app.get('/users', (req, res) => {
 var permissions = {'users_read'};
 if(permissions.indexof('token_flags')!=-1){
 ...} else{return false}
});

or

app.post('/users', permissions('users_read'), ()=>{
 ...
});

user1: users_read

user2: users_read , users_execute

user3: settings_read

admin1: access_all //user 1&2 and admin will get api resonse, user3 not

Answer 1

you can store your pages into a object as index or key then just set the autorized users type as value in an array way

var user_type = 1; // 1: user, 2: staff, 3: admin

var permissions = {
    'users_read': [1, 2, 3],
    'users_execute': [2, 3],
    'settings_read': [3]
};


app.get('/users', (req, res) => {
    var page = 'users_read';
    if(permissions[page].indexOf(user_type) != -1){
        // autorized
    } else{
        return false
    }
});