check-role

check-role  
Express middleware for role-based authorization. Protect your routes by specifying allowed roles.  

---
📦 Installation  
npm install check-role

🚀 Basic Usage

1. Apply to Express Routes

import express from 'express';
import checkRole from 'check-role';

const app = express();

// Admin-only route
app.get('/admin', checkRole(['admin']), (req, res) => {
  res.send("Admin Dashboard");
});

// Route for admins and sellers
app.get('/sales', checkRole(['admin', 'seller']), (req, res) => {
  res.send("Sales Data");
});

2. Requires req.user

Ensure your authentication middleware sets req.user with a role property:

// Example authentication setup
app.use((req, res, next) => {
  // Typically set by Passport/JWT middleware
  req.user = { 
    id: 1001, 
    role: 'seller' // Required property
  };
  next();
});

⚠️ Error Responses

401 Unauthorized

When user isn't authenticated (req.user missing):

{
  "success": false,
  "message": "User not authenticated"
}

403 Forbidden

When user role isn't allowed:

{
  "success": false,
  "message": "Access denied. Allowed roles: admin, seller"
}

💡 Best Practices

• Always place after authentication middleware (e.g., Passport, JWT auth)
• Use for role-restricted routes only
• Ensure req.user.role is a string (e.g., 'admin')

⁉️ FAQ

Q: What if req.user exists but has no role property?
A: Returns 401 - "User not authenticated"

Q: Can I use numeric roles?
A: Only string roles are supported (e.g., ['1', '2'] would work but isn't recommended)

Q: Is this compatible with Fastify?
A: No, this is designed for Express.js

🔧 Contribution

PRs welcome! GitHub Repository