Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

const express = require('express');
const jwt     = require('jsonwebtoken');
const router  = express.Router();

const SECRET = process.env.JWT_SECRET || 'secret';

// Auth middleware — attaches decoded payload to req.user
function authenticate(req, res, next) {
    const [, token] = (req.headers.authorization || '').split(' ');
    try {
        req.user = jwt.verify(token, SECRET);
        next();
    } catch {
        res.status(401).json({ error: 'Unauthorized' });
    }
}

// RBAC middleware factory
function authorize(...roles) {
    return (req, res, next) => {
        if (!roles.includes(req.user?.role)) {
            return res.status(403).json({ error: 'Forbidden' });
        }
        next();
    };
}

// Permission-based guard
function can(permission) {
    return (req, res, next) => {
        const perms = req.user?.permissions || [];
        if (!perms.includes(permission)) {
            return res.status(403).json({ error: `Missing permission: ${permission}` });
        }
        next();
    };
}

// Routes
router.get('/admin/dashboard',
    authenticate, authorize('admin'), (req, res) => {
    res.json({ secret: 'admin data' });
});

router.delete('/posts/:id',
    authenticate, can('posts:delete'), (req, res) => {
    res.status(204).end();
});

module.exports = router;