Merge pull request #34 from abhijit1859/feat/middleware-rbac

feat(middleware): add authentication middleware

Author: Somilg11

package-lock.json

@@ -2,6 +2,7 @@ import express from 'express';
 import cors from 'cors';
 import cookieparser from 'cookie-parser';
 import authRoutes from './routes/authRoutes.js';
+import rbacRoutes from './routes/rbacRoutes.js';
 
 const app = express();
 
@@ -15,7 +16,8 @@ app.use(express.urlencoded({ extended: true, limit: '16kb' }));
 app.use(express.static('public'));
 app.use(cookieparser());
 
-// Routes
+//routes
 app.use('/api/auth', authRoutes);
+app.use('/api/rbac-test', rbacRoutes);
 
 export { app };

src/app.js

@@ -0,0 +1,25 @@
+import jwt from 'jsonwebtoken';
+
+export const authMiddleware = (req, res, next) => {
+	const authHeader = req.headers.authorization;
+
+	if (!authHeader || !authHeader.startsWith('Bearer')) {
+		return res.status(401).json({
+			message: "Unauthorize : No token provided"
+		});
+	}
+
+	const token = authHeader.split(" ")[1];
+
+	try {
+		const decoded = jwt.verify(token, process.env.JWT_SECRET);
+	 
+		req.user = decoded;
+		next();
+	} catch (error) {
+		console.error("Error: ", error.message);
+		return res.status(401).json({ message: "Unauthorized: Invalid token" });
+	}
+}
+
+

src/middlewares/auth.middleware.js

@@ -0,0 +1,21 @@
+export const checkRole = (roles = []) => {
+	return (req, res, next) => {
+		if (!Array.isArray(roles) || roles.length === 0) {
+			return res.status(500).json({ message: "RBAC misconfiguration: roles array is required" });
+		}
+
+		const userRole = req?.user?.role;
+		if (!userRole) {
+			return res.status(403).json({ message: "Forbidden: Role is missing" });
+		}
+
+		const isAllowed = roles.includes(userRole);
+		if (!isAllowed) {
+			return res.status(403).json({ message: "Forbidden" });
+		}
+
+		return next();
+	};
+};
+
+

src/middlewares/rbac.middleware.js

@@ -0,0 +1,22 @@
+import express from 'express';
+import { authMiddleware } from '../middlewares/auth.middleware.js';
+import { checkRole } from '../middlewares/rbac.middleware.js';
+
+const router = express.Router();
+
+
+router.get('/admin-only', authMiddleware, checkRole(['Admin']), (req, res) => {
+	return res.status(200).json({ message: 'Welcome, Admin' });
+});
+
+ 
+router.get('/user-only', authMiddleware, checkRole(['User']), (req, res) => {
+	return res.status(200).json({ message: 'Welcome, User' });
+});
+
+ 
+ 
+
+export default router;
+
+