XirfadHub Roadmap
Backend Development
Step 14 / 2090 min

Authorization & Roles

Auth & Security

Explanation

Authentication says who you are. Authorization decides what you can do — admin vs student vs owner.

Code example

typescript
function requireRole(roles: string[]) {
  return (req, res, next) => {
    if (!req.user || !roles.includes(req.user.role)) {
      return res.status(403).json({ error: "Forbidden" });
    }
    next();
  };
}

Helpful resources

Exercise

Protect DELETE /api/skills/:id so only ADMIN or the resource owner can delete.