authentication-middleware-express.js

const mongoose = require('mongoose'),
	models = require('./models'),
	jwt = require('jsonwebtoken')

app.all('*', (req, res, next) => {
	const noAuthorization = ['/login', '/resetPassReq', '/resetPass', '/signup'];
	if (noAuthorization.indexOf(req.path) !== -1) { // does not require authentication
		return next()
	}

	// authenticate
	let authUser
	if (typeof req.headers.authorization !== 'undefined') {
		try {
			authUser = jwt.verify(req.headers.authorization, process.env.TOKEN_SECRET)
		} catch (err) {
			return res.status(400).json({
				status: err.message,
			})
		}
	} else {
		return res.status(403).json({
			status: "Not logged in",
			meta: null
		})
	}

	models.users.findOne({
		ID: authUser.ID
	}, (err, user) => {
		if (err) {
			return next(err, false)
		}
		if (!user) {
			return res.status(404).json({
				status: "User does not exist",
				meta: null
			});
		}
		// authorize
		const roleAccess = {}
		roleAccess.student = ['/profile', '/buses', '/savenotificationtoken']
		roleAccess.driver = ['/ride']
		roleAccess.fo = ['/addseatcash', '/register']
		roleAccess.sao = roleAccess.student.concat(['/term', '/addbus', '/removebus', '/pushnotification', '/rides']);
		roleAccess.admin = roleAccess.sao.concat(['/changerole']).concat(roleAccess.fo)
		if (roleAccess[user.role] && roleAccess[user.role].indexOf(req.path) === -1) {
			console.log(`a ${user.role} was trying to authorize to ${req.path} but got kicked out`)
			return res.status(401).json({
				status: "User unauthorized",
				meta: null
			})
		}
		req.authUser = user
		next()
	})
})