How can I implement role-based access control in Express.js?

How can I implement role-based access control in Express.js?

You can implement role-based access control (RBAC) in Express.js by using middleware to check user roles before granting access to certain routes.

What libraries can help with RBAC in Express?

You can use libraries like 'express-jwt' for authentication and 'casl' or 'accesscontrol' for managing roles and permissions.

Can you show me a code example?

Sure! Here's a simple example:

const express = require('express');
const app = express();

const roles = {
  admin: 'admin',
  user: 'user'
};

const checkRole = (role) => {
  return (req, res, next) => {
    if (req.user.role === role) {
      next();
    } else {
      res.status(403).send('Access denied.');
    }
  };
};

app.get('/admin', checkRole(roles.admin), (req, res) => {
  res.send('Welcome Admin!');
});

app.listen(3000);

This code checks if the user has the 'admin' role before allowing access to the '/admin' route.

What if I want to allow multiple roles access?

You can modify the checkRole middleware to accept an array of roles and check if the user's role is included in that array.