RBAC Microservice System (Node.js)

A scalable Role-Based Access Control (RBAC) system built using microservice architecture with Node.js, Express, MongoDB, and JWT authentication. Designed for reusable middleware and production-ready backend systems.

Features

• JWT authentication
• User (Auth) service
• Role and Permission (RBAC) service
• Service-to-service communication using Axios
• No cross-service populate (microservice-safe)
• Clean and scalable architecture
• Reusable middleware (npm-ready)

Architecture Overview

Auth Service (User - 9991) | | HTTP (Axios) v RBAC Service (Role & Permission - 9999)

Services

Auth Service (User)

• Handles user login and authentication
• Generates JWT tokens
• Stores user data with role reference

RBAC Service

• Manages roles
• Manages permissions
• Handles access control logic

Tech Stack

• Node.js
• Express.js
• MongoDB with Mongoose
• JSON Web Token (JWT)
• Axios

Environment Variables

Auth Service (.env)

PORT=9991 MONGO_URI=your_mongo_uri JWT_SECRET=your_secret_key ROLE_SERVICE_URL=http://localhost:9999/microservice/role

RBAC Service (.env)

PORT=9999 MONGO_URI=your_mongo_uri JWT_SECRET=your_secret_key USER_SERVICE_URL=http://localhost:9991/microservice/user

Authentication Flow

1. User logs in via Auth Service
2. JWT token is generated
3. Client sends token in headers: Authorization: Bearer
4. Middleware verifies token
5. Role and permissions are resolved via API or JWT

Middleware Usage

import { protect } from "./middleware/protect.js";

app.get("/secure-route", protect, (req, res) => {
  res.json({ message: "Access granted", user: req.user });
});

Microservice Communication Example

const response = await axios.get(
  `${process.env.ROLE_SERVICE_URL}/${user.role}`
);

const role = response.data.role;

Best Practices

• Do not use populate across microservices
• Use API-based communication
• Keep services independent
• Use environment variables for configuration
• Maintain separation of concerns

Future Enhancements

• API Gateway
• Redis caching
• Store permissions in JWT
• Rate limiting and security improvements
• TypeScript support

NPM Usage (Reusable Middleware)

npm install your-package-name

import { protect } from "your-package-name";

app.get("/secure", protect, (req, res) => {
  res.send("Protected route");
});

Author

Praveen Digitalks

License

MIT