root
33 lines
923 B
TypeScript
33 lines
923 B
TypeScript
import { Request, Response, NextFunction } from 'express'
|
|
import { EmployeeRole } from '@rentaldrivego/database'
|
|
|
|
const ROLE_RANK: Record<EmployeeRole, number> = {
|
|
OWNER: 3,
|
|
MANAGER: 2,
|
|
AGENT: 1,
|
|
}
|
|
|
|
export function requireRole(minimumRole: EmployeeRole) {
|
|
return (req: Request, res: Response, next: NextFunction) => {
|
|
const employee = req.employee
|
|
if (!employee) {
|
|
return res.status(401).json({ error: 'unauthenticated', message: 'Authentication required', statusCode: 401 })
|
|
}
|
|
|
|
const employeeRank = ROLE_RANK[employee.role] ?? 0
|
|
const requiredRank = ROLE_RANK[minimumRole] ?? 99
|
|
|
|
if (employeeRank < requiredRank) {
|
|
return res.status(403).json({
|
|
error: 'forbidden',
|
|
message: `This action requires the ${minimumRole} role or higher`,
|
|
statusCode: 403,
|
|
requiredRole: minimumRole,
|
|
yourRole: employee.role,
|
|
})
|
|
}
|
|
|
|
next()
|
|
}
|
|
}
|