What is the best practice for creating a route that can be accessed by 2 roles NodeJs答案

【问题标题】：What is the best practice for creating a route that can be accessed by 2 roles NodeJsWhat is the best practice for creating a route that can be accessed by 2 roles NodeJs
【发布时间】：2022-12-02 06:30:13
【问题描述】：

Regarding best practice in creating routes in Node.Js Express.Js. For example, if I have 4 roles, namely headmaster, student and teacher, then I have a route called /sliders, which in the application these sliders can be seen by both teacher, student, and administrator only.

When creating routes and middleware for checking roles, what are the best practices?

I. Should I create 1 endpoints and 1 middleware that can be access by student and teacher only?

For example:

v1.get('/sliders', isUserOrTeacher, controller.findAll)

and my middleware code:

const isUserOrTeacher = (req, res, next) => {
  User.findById(req.payload.aud).exec((err, user) => {
    if (err) {
      res.status(500).send({ message: err })
      return
    }

    Role.find(
      {
        _id: { $in: user.roles }
      },
      (err, roles) => {
        if (err) {
          res.status(500).send({ message: err })
          return
        }

        for (let i = 0; i < roles.length; i++) {
          if (roles[i].name === 'student' || roles[i].name === 'teacher' || roles[i].name === 'admin') {
            next()
            return
          }
        }

        logger.error(req.method, req.originalUrl, '. Error isUserOrTeacher: ' + req.payload)
        return sendUnauthorized(res)
      }
    )
  })
}

II. or i should make 2 different endpoint and 2 middleware

for example:

v1.get('/user/sliders', isUser, controller.findAll)
v1.get('/teacher/sliders', isTeacher, controller.findAll)

III. or can i make route like this?? And how the coding? for middleware:

v1.get('/sliders', isUser, isTeacher, isAdmin, controller.findAll)

Which one is the best practice?

【问题讨论】：

1st solution is the best one for me, you are in a specific case so a specific middleware isn't a bad thing
what if i have add the another rule someday? I should add roles[i].name === 'staff' in if condition inside isUserOrTeacher function? @ValentinMarguerie
You will need to modify your middleware to match this new case but that is for me the only real solution. For instance, your last solution cannot work simply because, if someone is an Admin, he will not pass isUser and isTeacher middleware and the second on is a bit weird because you are reaching the same function with 2 routes.

标签： javascript node.js

【解决方案1】：

I will do a middleware named canGet<Controller name> and the code in it will be

 switch(userRole): 
  case 'teacher':
    next();
    break;
  case 'user':
    next();
    break;
  default:
   res.statut(403);

And then you can add any role in it, and without changing the name of the function in your route

【讨论】：