How can I implement role-based access control in a TypeScript Express app using JWT?

How can I implement role-based access control in a TypeScript Express app using JWT?

To implement role-based access control (RBAC) in a TypeScript Express app using JWT, you can follow these steps: 1. Define user roles (e.g., admin, user). 2. Create a middleware to check the user's role from the JWT. 3. Protect your routes by applying this middleware.

Can you show me an example of the middleware?

Sure! Here's a simple example of a middleware function:

import { Request, Response, NextFunction } from 'express';
import jwt from 'jsonwebtoken';

const roleMiddleware = (roles: string[]) => {
    return (req: Request, res: Response, next: NextFunction) => {
        const token = req.headers['authorization']?.split(' ')[1];
        if (!token) return res.status(403).send('Access denied. No token provided.');

        jwt.verify(token, 'your_jwt_secret', (err, decoded) => {
            if (err) return res.status(403).send('Invalid token.');
            if (!roles.includes(decoded.role)) return res.status(403).send('Access denied.');
            next();
        });
    };
};

You can use this middleware in your routes by passing the allowed roles.

What about the JWT generation part?

For JWT generation, you can use the jsonwebtoken library. Here's a basic example:

import jwt from 'jsonwebtoken';

const generateToken = (user: { id: string; role: string }) => {
    return jwt.sign({ id: user.id, role: user.role }, 'your_jwt_secret', { expiresIn: '1h' });
};

You would call this function after validating the user's credentials to issue a token.

Thanks! This is really helpful.

You're welcome! If you have any more questions about TypeScript, Express, or JWT, feel free to ask!