| const jwt = require('jsonwebtoken'); |
| const User = require('../models/User'); |
|
|
| const authenticateToken = async (req, res, next) => { |
| try { |
| const token = req.header('Authorization')?.replace('Bearer ', ''); |
| |
| if (!token) { |
| return res.status(401).json({ message: 'Access denied. No token provided.' }); |
| } |
|
|
| const decoded = jwt.verify(token, process.env.JWT_SECRET); |
| const user = await User.findById(decoded.userId); |
| |
| if (!user) { |
| return res.status(401).json({ message: 'Invalid token.' }); |
| } |
|
|
| req.user = { |
| userId: user._id, |
| role: user.role |
| }; |
| |
| next(); |
| } catch (error) { |
| res.status(401).json({ message: 'Invalid token.' }); |
| } |
| }; |
|
|
| const authorizeRoles = (...roles) => { |
| return (req, res, next) => { |
| if (!roles.includes(req.user.role)) { |
| return res.status(403).json({ message: 'Access denied. Insufficient permissions.' }); |
| } |
| next(); |
| }; |
| }; |
|
|
| module.exports = { authenticateToken, authorizeRoles }; |
