如何允许特定的用户类别访问特定的应用程序路线？

Question

My application consists of two type of users. Let's say A and B. Both of them first needs to authenticated. Authentication is done. But now i want A to access specific routes and if it tries to access B routes i want to give A error like access denied to this route and same for B. A is type=0 and B is type=1.
For authetication i am using this middleware which uses token:

auth.js:

const authenticate = (req, res, next)  => {

    var token = req.cookies['x-auth'];

    User.findByToken(token).then(user => {
        if(!user){
            return Promise.reject();
        }
        req.user = user;
        next();

    }).catch(err => {
        console.log(err);
        var response = {
            status:'failure',
            message: err.message
        };
        res.status(401).send(response);
    })
};

How should i proceed to achieve this?

Answer 1

Here's your solution, where roles is an array of strings containing the allowed roles for that specific route. This also implies that the users (in your MongoDB model) have a role field.

const authenticateWithRole = (roles = []) => {
   return async (req, res next) => {
      const token = req.cookies['x-auth'];

      try {
         const user = await User.findByToken(token);

         if (roles.includes(user.role)) {
            // Store the informations for the middleware
            req.user = user;

            next();
         } else {
            res.status(403).send({
               // Your error-response here...
            });
         }
      }
      catch (e) {
         res.status(401).send({
            // Your error-response here...
         });
      }
   }
}

// Later in your APIs

app.use('/limited-route', authenticateWithRole([
   'admin', 
   'student'
]), (req, res) => {

});