Implementing Authorization

export const requireRole = (...roles) => (req, res, next) => {
  if (!req.user)               return next(new HttpError(401));
  if (!roles.includes(req.user.role)) return next(new HttpError(403));
  next();
};

app.delete("/admin/users/:id", requireAuth, requireRole("admin"), removeUser);

const PERMS = {
  admin:  ["user:*", "post:*"],
  editor: ["post:read", "post:write"],
  user:   ["post:read"]
};

export function hasPermission(role, perm) {
  return (PERMS[role] || []).some(p => p === perm || p.endsWith(":*") && perm.startsWith(p.slice(0, -1)));
}

export const can = (perm) => (req, res, next) =>
  hasPermission(req.user?.role, perm) ? next() : next(new HttpError(403));

import AccessControl from "accesscontrol";

const ac = new AccessControl();
ac.grant("user").readOwn("post").createOwn("post");
ac.grant("admin").extend("user").readAny("post").deleteAny("post");

const permission = ac.can(req.user.role).readAny("post");
if (!permission.granted) throw new HttpError(403);

app.delete("/posts/:id", requireAuth, async (req, res, next) => {
  const post = await db.posts.findById(req.params.id);
  if (!post) return next(new HttpError(404));
  if (post.authorId !== req.user.sub && req.user.role !== "admin") {
    return next(new HttpError(403));
  }
  await db.posts.remove(req.params.id);
  res.sendStatus(204);
});

// policies/post.js
export const canEditPost = (user, post) =>
  user.role === "admin" ||
  (post.authorId === user.sub && !post.locked && post.status !== "published");

// route
if (!canEditPost(req.user, post)) throw new HttpError(403);

app.patch("/orgs/:orgId/projects/:id",
  requireAuth,
  requireOrgMember(),     // sets req.membership
  requireRole("owner","editor"),
  loadProject(),          // sets req.project
  authorize((req) => canEditProject(req.user, req.project)),
  updateProject
);

if (!req.user) {
  res.set("WWW-Authenticate", 'Bearer realm="api"');
  throw new HttpError(401);
}
if (!hasPermission(req.user.role, "post:delete")) throw new HttpError(403);

export const requireScope = (...scopes) => (req, res, next) => {
  const token = req.user?.scope?.split(" ") || [];
  const ok = scopes.every(s => token.includes(s));
  ok ? next() : next(new HttpError(403, "Insufficient scope"));
};

app.get("/me/email", requireAuth, requireScope("read:email"), getEmail);

// Filter at query time — never trust client to filter
const posts = await prisma.post.findMany({
  where: {
    OR: [
      { authorId: req.user.sub },
      { collaborators: { some: { userId: req.user.sub } } },
      ...(req.user.role === "admin" ? [{}] : [])
    ]
  }
});