How can we implement an admin panel in nodeJS with express?

Question

I am making a Portfolio application with nodeJS and express. I want to implement an admin panel which I can create,delete, update and edit my skills,experience,about etc, but I don't know how can I keep those admin routes secret and what kind of authentication to make.If we can do by putting Basic authentication on post,patch,delete route then how will we implement basic authentication on routes.

index.js

const express = require('express');
const app = express();
var cors = require('cors');

require('./db/mongoose')
const menuRouter = require('./routers/menu')
const skillRouter = require('./routers/skill')
const aboutRouter = require('./routers/About')
const experienceRouter = require('./routers/Experience')
const resumerouter = require('./routers/Resume')
const userRouter = require('./routers/user')
const port = process.env.PORT || 4000;
app.use(express.json());
app.use(cors());

app.use(menuRouter);
app.use(skillRouter);
app.use(aboutRouter);
app.use(experienceRouter);
app.use(resumerouter);
app.use(userRouter)
app.listen(port, () => {
    console.log("Server is runing on port" + port)
});

skill.js

const express = require('express');
const Skill = require('../model/skill');
const router = new express.Router();
router.post('/skill', async (req, res) => {
    const skill = new Skill(req.body);

    try {
        await skill.save();
        res.status(201).send(skill);
    } catch (e) {
        console.log(e);
        res.status(400).send(e);
    }

})
router.get('/skill', async (rq, res) => {

    try {
        const skill = await Skill.find({});
        res.status(201).send(skill);
    } catch (e) {
        res.status(400).send(e);
    }


})

module.exports = router;

Answer 1

As specified in the comments, I would refactor your code a bit, seems messy and you're kind'a repeating yourself every line you import a route, so, you should do it better as well...

have an index.js file in your /routers folder with the content of the demo repo I've made for other StackOverflow question

then, to separate things, I would do something like:

const routes = require('./routes')
...
const protectRouteWithApiKey = (req, res, next) => {
    const auth = req.headers['x-apikey']
    if (auth && auth === '<YOUR API KEY>') return next()
    return next(new Error('403 | Authorization is missing or value is wrong'))
}
...
app.use('/api', protectRouteWithApiKey, routes) // point to your routes and protect access
app.use('/', defaultEngine) // your engine to render html

you would then have a protected route in /api/* and normal routes for everything else

Answer 2

A middleware where you detect if the logged user is the admin?

In this sample checking by the email, and you can save the adminemail as a global variable

ensureAdmin: function(req, res, next) {
    if (req.isAuthenticated()) {
      if (req.user.email === adminemail) {
        return next();
      } else {
        return res.redirect('/adminsecretroute');
      }
    }
    res.redirect('/');
  }