I want to have 2 access roles: admin and superadmin.
Superadmin can create, read, update and delete posts. Admin can read, update posts.
I have the middlewares already:
const verifyAdminStatus = (req, res, next) => {
//pseudocode: if (user === 'admin') next();
}
const verifySuperAdminStatus = (req, res, next) => {
//pseudocode: if (user === 'superadmin') next();
}
For create and delete it works fine:
router.post("/api/posts", [verifyToken, verifySuperAdminStatus], createPost);
router.delete("/api/posts/:id", [verifyToken, verifySuperAdminStatus], deletePost);
But for update and read, I can't put both middlewares, because either one of them will not have the access. How can I implement a solution where both admins and superadmins can update and read. Do I need to create a new middleware that checks both?
you can use a factory of middleware to have only one middleware that manages the different cases as follow:
const authMiddleware = (roles) => {
return (req,res,next) => {
roles.forEach(role => {
if(["admin", "superadmin"].includes(role)) return next();
})
return res.status(403).json({
message: "Forbidden"
})
}
}
router.post("/api/posts", [verifyToken, authMiddleware(["Admin"])], createPost);
router.delete("/api/posts/:id", [verifyToken, authMiddleware(["SuperAdmin"]], deletePost);
router.delete("/api/posts/another-endpoint", [verifyToken, authMiddleware(["SuperAdmin", "Admin"]], deletePost);
The last endpoint can be consumed for an Admin or Super Admin role.