39 lines
1.3 KiB
JavaScript
39 lines
1.3 KiB
JavaScript
const jwt = require("jsonwebtoken");
|
|
const config = require("../config/auth.config");
|
|
const {db} = require('../modules/db');
|
|
const User = db.user;
|
|
|
|
verifyToken = (req, res, next) => {
|
|
const token = req.headers["x-access-token"] || req.headers.authorization;
|
|
|
|
if (!token) return res.status(403).send({message: "No token provided!"});
|
|
|
|
const raw = token.startsWith("Bearer ") ? token.slice(7) : token;
|
|
jwt.verify(raw, config.JWT_SECRET, (err, decoded) => {
|
|
if (err) return res.status(401).send({message: "Unauthorized!",});
|
|
req.userId = decoded.id;
|
|
next();
|
|
});
|
|
};
|
|
|
|
const requireRole = (roleNames) => async (req, res, next) => {
|
|
try {
|
|
if (!req.userId) return res.status(401).send({message: "User ID missing in request."});
|
|
const user = await User.findByPk(req.userId);
|
|
if (!user) return res.status(404).send({message: "User not found."});
|
|
|
|
const roles = await user.getRoles();
|
|
const has = roles.some(r => roleNames.includes(r.name));
|
|
if (!has) return res.status(403).send({message: `Require ${roleNames.join(" or ")} Role!`});
|
|
|
|
next();
|
|
} catch (err) {
|
|
console.error("Role check error:", err);
|
|
res.status(500).send({message: "Internal server error."});
|
|
}
|
|
};
|
|
|
|
module.exports = {
|
|
verifyToken,
|
|
isAdmin: requireRole(["admin"])
|
|
}; |