Node.js Backend Development Bootcamp · 课时

基于角色的访问控制

开发授权中间件，根据用户角色和权限限制对 API 路由的访问。

基于角色的访问控制 是 CoddyKit 上的免费 Node.js Backend Development Bootcamp 课时。这是第 5 节课，共 6 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Node.js Backend Development Bootcamp 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Node.js Backend Development Bootcamp 课程共包含 6 节课。

本课时的部分内容尚未翻译，以英文显示。

Intro to Role-Based Access Control

Welcome! In this lesson, we'll dive into Role-Based Access Control (RBAC). RBAC is a method of restricting system access based on the roles individual users have within an organization.

Think of it like a set of keys: each key (role) grants access to specific doors (resources or actions). Instead of giving each person a key to every door, you give them a keyring based on their job.

Importance of RBAC

RBAC is crucial for building secure and scalable applications. It offers several benefits:

Improved Security: Users only access what they need.
Simplified Management: Easier to manage permissions for groups rather than individuals.
Reduced Errors: Less chance of granting incorrect access.
Enhanced Compliance: Helps meet regulatory requirements for data access.

Without RBAC, managing permissions in a growing application becomes a nightmare!

Roles & Permissions Defined

It's important to understand the difference between roles and permissions:

Role: A collection of permissions. Examples: Admin, Editor, Viewer, Guest.
Permission: A specific action a user can perform. Examples: read:post, write:post, delete:user.

A user is assigned one or more roles, and each role has a set of defined permissions. This structure makes access control flexible.

How to Store User Roles

When a user registers or logs in, their assigned roles need to be stored. Common ways to do this include:

Database Field: A string (e.g., "admin", "user") or an array of strings (e.g., ["admin", "editor"]) in the user's document/record.
JWT Payload: Include the roles directly in the JSON Web Token (JWT) during login. This makes them easily accessible on each request.

For our examples, we'll assume roles are available on the req.user object, which would be populated by a preceding authentication middleware (like one from a previous lesson).

Authorization Middleware Flow

In Express.js, middleware functions are perfect for authorization. An authorization middleware sits between the request and the route handler.

Here's how it works:

A request comes in for a protected route.
Our authorization middleware runs.
It checks if the authenticated user has the necessary role(s).
If yes, it calls next() to pass control to the route handler.
If no, it sends an error response (e.g., 403 Forbidden).

Define Role Check Middleware

We'll create a reusable middleware function that checks if an authenticated user has a specific role. This function accepts the requiredRole as an argument and returns another middleware function.

A real application would first have an authentication middleware populating req.user.

function authorizeRoles(requiredRole) {
  return (req, res, next) => {
    // Assume req.user is populated by auth middleware
    // e.g., req.user = { id: 'abc', roles: ['user', 'editor'] }
    if (!req.user || !req.user.roles || !req.user.roles.includes(requiredRole)) {
      console.log(`Access Denied: Missing role '${requiredRole}'`);
      return res.status(403).send('Forbidden: Insufficient role');
    }
    console.log(`Access Granted for role '${requiredRole}'`);
    next(); // User has the required role, proceed
  };
}

// To make it runnable for demonstration, let's wrap it in a mock Express-like setup
const mockReq = { user: { id: '123', roles: ['user', 'admin'] } };
const mockRes = {
  status: function(code) { this.statusCode = code; return this; },
  send: function(msg) { console.log(`Response Status: ${this.statusCode}, Message: ${msg}`); }
};
const mockNext = () => console.log('Next middleware/route handler called.');

console.log('--- Testing authorizeRoles("admin") ---');
const adminAuth = authorizeRoles('admin');
adminAuth(mockReq, mockRes, mockNext);

console.log('\n--- Testing authorizeRoles("guest") ---');
const guestAuth = authorizeRoles('guest');
guestAuth(mockReq, mockRes, mockNext);

Protecting Routes with RBAC

Now, let's see how to apply our authorizeRoles middleware to protect specific routes in an Express.js application.

We can pass the middleware function directly to a route definition. Any request to that route will first pass through the authorization check.

const express = require('express');
const app = express();

// Mock authentication middleware (from previous lessons)
app.use((req, res, next) => {
  // In a real app, this would verify a JWT and populate req.user
  req.user = { id: 'user123', roles: ['user', 'viewer'] };
  next();
});

// Our authorization middleware
function authorizeRoles(requiredRole) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles.includes(requiredRole)) {
      return res.status(403).send('Forbidden: Insufficient role');
    }
    next();
  };
}

// Route accessible only by 'admin'
app.get('/admin-panel', authorizeRoles('admin'), (req, res) => {
  res.send('Welcome to the Admin Panel!');
});

// Route accessible by 'user' or 'viewer' (since req.user has 'user', 'viewer')
app.get('/my-profile', authorizeRoles('user'), (req, res) => {
  res.send(`Hello ${req.user.id}, this is your profile.`);
});

app.listen(3000, () => {
  console.log('Server running on port 3000. Try accessing /admin-panel or /my-profile');
});

Handling Multiple Required Roles

Sometimes a route might be accessible by more than one role (e.g., an Editor or an Admin). We can extend our middleware to accept multiple required roles.

The user just needs to have *at least one* of the specified roles to gain access.

const express = require('express');
const app = express();

// Mock authentication middleware
app.use((req, res, next) => {
  req.user = { id: 'editor456', roles: ['user', 'editor'] };
  next();
});

// Middleware to check for multiple roles
function authorizeAnyRole(requiredRoles) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles) {
      return res.status(403).send('Forbidden: User roles not found');
    }
    const hasRequiredRole = req.user.roles.some(role =>
      requiredRoles.includes(role)
    );
    if (!hasRequiredRole) {
      return res.status(403).send('Forbidden: Insufficient role(s)');
    }
    next();
  };
}

// Route accessible by 'admin' OR 'editor'
app.get('/edit-content', authorizeAnyRole(['admin', 'editor']), (req, res) => {
  res.send('You can edit content!');
});

// Route accessible by 'admin' only
app.get('/delete-all', authorizeAnyRole(['admin']), (req, res) => {
  res.send('Danger Zone: All data deleted!');
});

app.listen(3000, () => {
  console.log('Server running on port 3000. Try /edit-content or /delete-all');
});

Beyond Roles: Granular Permissions

While roles are great for grouping permissions, sometimes you need more granular control. This is where explicit permissions come in.

Instead of authorizeRoles('admin'), you might have authorizePermission('delete:user').
Your user object would then store an array of specific permissions (e.g., ['read:post', 'update:post', 'delete:comment']).

This approach offers maximum flexibility but can increase complexity in managing permissions.

Check Your Understanding

Consider the following Express route setup:

// ... (assume authorizeRoles function is defined as in lesson)
app.use((req, res, next) => {
  req.user = { id: 'testUser', roles: ['user', 'moderator'] };
  next();
});

app.get('/moderate', authorizeRoles('moderator'), (req, res) => {
  res.send('Moderator access granted.');
});

app.get('/admin-only', authorizeRoles('admin'), (req, res) => {
  res.send('Admin access granted.');
});

Recap & Next Steps

Great job! You've learned how to implement Role-Based Access Control in your Node.js applications using Express.js middleware.

RBAC restricts access based on user roles.
Middleware functions are ideal for checking roles before route access.
You can check for single roles or multiple roles.
Advanced scenarios might involve direct permission checks.

Proper authorization is key to securing your API. Keep practicing to master these concepts!

常见问题解答

「基于角色的访问控制」课时是免费的吗？

是的 — 「基于角色的访问控制」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Node.js Backend Development Bootcamp 课程的其余内容，请升级到 CoddyKit PRO。 Node.js Backend Development Bootcamp 课程共包含 6 节课。

「基于角色的访问控制」这节课中我会学到什么？

开发授权中间件，根据用户角色和权限限制对 API 路由的访问。你通过在浏览器中直接运行的动手代码来练习 Node.js Backend Development Bootcamp，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Node.js Backend Development Bootcamp 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Node.js Backend Development Bootcamp 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 5 节课，共 6 节。

「基于角色的访问控制」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Node.js Backend Development Bootcamp 课中编写并运行代码吗？

能。每节 Node.js Backend Development Bootcamp 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Node.js Backend Development Bootcamp