Implementing Role-Based Access Control

In this lesson, you will learn how to design a scalable middleware architecture that enforces Role-Based Access Control (RBAC) to gate sensitive API routes.

The Core Concept

RBAC decouples who a user is from what they can do. Instead of checking if a user has a specific ID, you check if their assigned role contains the permission required for a specific resource. In a production Node.js environment, this is best implemented as a factory function that returns middleware. This allows you to define granular access rules directly in your route definitions.

Building the Middleware Factory

By creating a function that accepts an array of authorized roles, you keep your route files clean and readable.

// middleware/authorize.js
const authorize = (allowedRoles) => {
  return (req, res, next) => {
    // Assuming user identity was attached by previous auth middleware
    const { role } = req.user;

    if (!allowedRoles.includes(role)) {
      return res.status(403).json({ error: 'Access Denied: Insufficient permissions' });
    }

    next();
  };
};

Implementing in Routes

Once the middleware is defined, protecting your endpoints becomes a declarative process. You can chain this after your standard token validation middleware to ensure the user is both authenticated and authorized.

const express = require('express');
const router = express.Router();

// Only Admins can access the user management dashboard
router.delete('/users/:id', 
  authenticateToken, 
  authorize(['admin']), 
  deleteUserHandler
);

// Both Admins and Moderators can edit posts
router.put('/posts/:id', 
  authenticateToken, 
  authorize(['admin', 'moderator']), 
  editPostHandler
);

Why This Scales

Using a factory pattern ensures that if your application grows to support more complex hierarchies or "permissions" (actions like read, write, delete) rather than just "roles," you only need to update the logic inside the authorize function. Since you are already managing sessions via Redis and validating OAuth2 tokens, this middleware acts as the final gatekeeper, ensuring that your business logic remains protected even if the identity provider is compromised.

Key Takeaway: Implement RBAC using a reusable middleware factory to keep your route definitions declarative, secure, and easy to maintain as your user permission model evolves.