How can I implement role-based access control in an Express application?

How can I implement role-based access control in an Express application?

You can implement role-based access control (RBAC) in Express by using middleware to check user roles before granting access to certain routes.

What libraries or packages should I use for this?

You can use libraries like express-jwt for authentication and jsonwebtoken for handling tokens. Additionally, consider using passport for more complex scenarios.

Can you provide a code example?

Sure! Here's a simple example:

const express = require('express');
const jwt = require('jsonwebtoken');

const app = express();

const roles = {
  admin: 'admin',
  user: 'user'
};

const authMiddleware = (role) => {
  return (req, res, next) => {
    const token = req.headers['authorization'];
    if (!token) return res.sendStatus(403);
    jwt.verify(token, 'your_secret_key', (err, decoded) => {
      if (err) return res.sendStatus(403);
      if (decoded.role !== role) return res.sendStatus(403);
      next();
    });
  };
};

app.get('/admin', authMiddleware(roles.admin), (req, res) => {
  res.send('Welcome Admin!');
});

app.listen(3000, () => console.log('Server running on port 3000')); 

What if I want to allow multiple roles access to a route?

You can modify the middleware to check if the user's role is included in an array of allowed roles. Here's an example:

const authMiddleware = (roles) => {
  return (req, res, next) => {
    const token = req.headers['authorization'];
    if (!token) return res.sendStatus(403);
    jwt.verify(token, 'your_secret_key', (err, decoded) => {
      if (err) return res.sendStatus(403);
      if (!roles.includes(decoded.role)) return res.sendStatus(403);
      next();
    });
  };
};

app.get('/dashboard', authMiddleware([roles.admin, roles.user]), (req, res) => {
  res.send('Welcome to the dashboard!');
});