การควบคุมการเข้าถึงตามบทบาท

Intro to Role-Based Access Control

Importance of RBAC

Roles & Permissions Defined

How to Store User Roles

Authorization Middleware Flow

Define Role Check Middleware

function authorizeRoles(requiredRole) {
  return (req, res, next) => {
    // Assume req.user is populated by auth middleware
    // e.g., req.user = { id: 'abc', roles: ['user', 'editor'] }
    if (!req.user || !req.user.roles || !req.user.roles.includes(requiredRole)) {
      console.log(`Access Denied: Missing role '${requiredRole}'`);
      return res.status(403).send('Forbidden: Insufficient role');
    }
    console.log(`Access Granted for role '${requiredRole}'`);
    next(); // User has the required role, proceed
  };
}

// To make it runnable for demonstration, let's wrap it in a mock Express-like setup
const mockReq = { user: { id: '123', roles: ['user', 'admin'] } };
const mockRes = {
  status: function(code) { this.statusCode = code; return this; },
  send: function(msg) { console.log(`Response Status: ${this.statusCode}, Message: ${msg}`); }
};
const mockNext = () => console.log('Next middleware/route handler called.');

console.log('--- Testing authorizeRoles("admin") ---');
const adminAuth = authorizeRoles('admin');
adminAuth(mockReq, mockRes, mockNext);

console.log('\n--- Testing authorizeRoles("guest") ---');
const guestAuth = authorizeRoles('guest');
guestAuth(mockReq, mockRes, mockNext);

Protecting Routes with RBAC

const express = require('express');
const app = express();

// Mock authentication middleware (from previous lessons)
app.use((req, res, next) => {
  // In a real app, this would verify a JWT and populate req.user
  req.user = { id: 'user123', roles: ['user', 'viewer'] };
  next();
});

// Our authorization middleware
function authorizeRoles(requiredRole) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles.includes(requiredRole)) {
      return res.status(403).send('Forbidden: Insufficient role');
    }
    next();
  };
}

// Route accessible only by 'admin'
app.get('/admin-panel', authorizeRoles('admin'), (req, res) => {
  res.send('Welcome to the Admin Panel!');
});

// Route accessible by 'user' or 'viewer' (since req.user has 'user', 'viewer')
app.get('/my-profile', authorizeRoles('user'), (req, res) => {
  res.send(`Hello ${req.user.id}, this is your profile.`);
});

app.listen(3000, () => {
  console.log('Server running on port 3000. Try accessing /admin-panel or /my-profile');
});

Handling Multiple Required Roles

const express = require('express');
const app = express();

// Mock authentication middleware
app.use((req, res, next) => {
  req.user = { id: 'editor456', roles: ['user', 'editor'] };
  next();
});

// Middleware to check for multiple roles
function authorizeAnyRole(requiredRoles) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles) {
      return res.status(403).send('Forbidden: User roles not found');
    }
    const hasRequiredRole = req.user.roles.some(role =>
      requiredRoles.includes(role)
    );
    if (!hasRequiredRole) {
      return res.status(403).send('Forbidden: Insufficient role(s)');
    }
    next();
  };
}

// Route accessible by 'admin' OR 'editor'
app.get('/edit-content', authorizeAnyRole(['admin', 'editor']), (req, res) => {
  res.send('You can edit content!');
});

// Route accessible by 'admin' only
app.get('/delete-all', authorizeAnyRole(['admin']), (req, res) => {
  res.send('Danger Zone: All data deleted!');
});

app.listen(3000, () => {
  console.log('Server running on port 3000. Try /edit-content or /delete-all');
});

Beyond Roles: Granular Permissions

Check Your Understanding

// ... (assume authorizeRoles function is defined as in lesson)
app.use((req, res, next) => {
  req.user = { id: 'testUser', roles: ['user', 'moderator'] };
  next();
});

app.get('/moderate', authorizeRoles('moderator'), (req, res) => {
  res.send('Moderator access granted.');
});

app.get('/admin-only', authorizeRoles('admin'), (req, res) => {
  res.send('Admin access granted.');
});

Recap & Next Steps