northwind-rest-api/backend/middleware/verify-admin.js

Local REST API Exposing 'Northwind Traders' Database.

const jwt = require("jsonwebtoken");

function verifyAdmin(request, response, next) {
    if (!request.headers.authorization) return response.status(401).send("You are not logged-in.");
    const token = request.headers.authorization.substring(7); // Bearer the-token
    if (!token) return response.status(401).send("You are not logged-in.");
    jwt.verify(token, config.jwtKey, (err, payload) => {
        if (err) {
            if (err.message === "jwt expired") return response.status(403).send("Your login session has expired.");
            return response.status(401).send("You are not logged-in.");
        }
        const user = payload.user;
        if(user.role !== "Admin") return response.status(403).send("You are not Admin.");
        next();
    });
}

module.exports = verifyAdmin;