demo-middleware-4.js

// this function will be used to compose further middlewares
const restaurantEmployeeOnly = (restaurantIdSupplier, groupName) => async (req, res, next) => {
    // using such a supplier can be useful if the restaurant id can occur on different places within the request
    // for example within the payload of a POST request (req.body) or as a query param (req.query)
    // maybe you want to use a default value for the param.
    const restaurantId = restaurantIdSupplier(req);
    const {user} = req;

    if (!restaurantId || !user) {
        res.status(403).send("Unauthorized");
        return;
    }

    const permissionDoc = await db.collection("restaurants").doc(restaurantId).collection(groupName).doc(user.id); // your actual permission check may differ
    
    if (!permissionDoc.exists) {
        res.status(403).send("Unauthorized");
        return;
    }

    next();
};

// 
const restaurantOwnerOnly = restaurantIdSupplier => restaurantEmployeeOnly(restaurantIdSupplier, "OWNER");
const restaurantStaffOnly = restaurantIdSupplier => restaurantEmployeeOnly(restaurantIdSupplier, "STAFF");

app.put("/:restaurantId", [onlyLoggedInUsers, restaurantStaffOnly(req => req.params.restaurantId)], (req, res) => {
    // do your put operation here
    res.send();
});