37 lines
1.0 KiB
JavaScript
37 lines
1.0 KiB
JavaScript
// /middlewares/permissionMiddleware.js
|
|
|
|
const AppError = require('../utils/AppError');
|
|
|
|
const requirePermission = (requiredPermission) => {
|
|
const perms = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
|
|
return (req, res, next) => {
|
|
try {
|
|
if (!req.user) {
|
|
return next(new AppError('UNAUTHORIZED'));
|
|
}
|
|
|
|
const role = req.user.role;
|
|
if (!role) {
|
|
return next(new AppError('FORBIDDEN'));
|
|
}
|
|
|
|
const roleName = String(role.name || '').toLowerCase();
|
|
if (roleName === 'superadmin' || (role.isSystem && role.permissions.includes('*'))) {
|
|
return next();
|
|
}
|
|
|
|
// Check if any required permission is held by role
|
|
if (Array.isArray(role.permissions) && perms.some((p) => role.permissions.includes(p))) {
|
|
return next();
|
|
}
|
|
|
|
return next(new AppError('FORBIDDEN'));
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
};
|
|
};
|
|
|
|
module.exports = requirePermission;
|
|
module.exports.requires = requirePermission;
|