Building Reusable RBAC Auth Middleware in Express.js

Securing endpoints in an API is straightforward when an application only has two user types. As platforms introduce managers, external auditors, and billing operators, hardcoding if (user.role === 'admin') checks inside route controllers leads to fragmented security logic.

A robust authorization architecture defines granular permission scopes and enforces access via reusable middleware.

Defining Permission Scope Matrices

Map business roles to discrete action keys rather than checking role strings directly:

export type Permission = 
  | 'users:read'
  | 'users:write'
  | 'users:delete'
  | 'billing:view'
  | 'billing:manage'
  | 'analytics:export';

export type Role = 'superadmin' | 'organizationmanager' | 'editor' | 'viewer';

export const ROLEPERMISSIONS: Record<Role, Permission[]> = { superadmin: ['users:read', 'users:write', 'users:delete', 'billing:view', 'billing:manage', 'analytics:export'], organization_manager: ['users:read', 'users:write', 'billing:view', 'analytics:export'], editor: ['users:read', 'analytics:export'], viewer: ['users:read'] }; ```

Authoring the Express RBAC Middleware

The middleware verifies that authenticated user claims contain all permissions required by the route:

import { Request, Response, NextFunction } from 'express';
import { Permission, ROLE_PERMISSIONS, Role } from '../types/rbac';

export function requirePermissions(requiredPermissions: Permission[]) { return (req: Request, res: Response, next: NextFunction) => { const user = req.user;

if (!user || !user.role) { return res.status(401).json({ success: false, error: 'Unauthorized: Authentication required' }); }

const userPermissions = ROLE_PERMISSIONS[user.role as Role] || []; const hasPermission = requiredPermissions.every(permission => userPermissions.includes(permission) );

if (!hasPermission) { return res.status(403).json({ success: false, error: 'Forbidden: Insufficient permissions for this action' }); }

next(); }; } ```

Declarative Route Protection

This approach keeps route definitions clean, explicit, and easy to audit:

import { Router } from 'express';
import { authenticateJWT } from '../middleware/authenticate';
import { requirePermissions } from '../middleware/authorize';
import { deleteUserAccount, exportAuditLogs } from '../controllers/admin';

const router = Router();

router.delete( '/users/:id', authenticateJWT, requirePermissions(['users:delete']), deleteUserAccount );

router.get( '/analytics/export', authenticateJWT, requirePermissions(['analytics:export']), exportAuditLogs );

export default router; ```

Decoupling route handlers from role verification ensures that permission updates occur in one central matrix without requiring modifications across individual controller functions.