Skip to content

Improve code structure of routeRequiresAuthorization function #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkoenig134 merged 1 commit into from
Aug 18, 2025
Merged

Improve code structure of routeRequiresAuthorization function #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 27 additions & 16 deletions src/middlewares/routeRequiresAuthorization.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ export function routeRequiresAuthorization(
}

return (req: Request, res: Response, next: NextFunction) => {
const requestRoles = authenticator.getRoles(req, res);
if (debuggerInstance.enabled) debuggerInstance('Validating authentication roles: <%j>.', requestRoles);
const rawUserRoles = authenticator.getRoles(req, res);
if (debuggerInstance.enabled) debuggerInstance('Validating authentication roles: <%j>.', rawUserRoles);

const transformedRoles = requestRoles.map(transformUserRole);
const isAuthorized = permittedRoles.some((permittedRole) => isRoleMatched(permittedRole, transformedRoles));
const userRoles = rawUserRoles.map(Role.from);
const isAuthorized = permittedRoles.some((r) => isRoleMatched(r, userRoles));
if (!isAuthorized) {
next(new Errors.ForbiddenError('You are not allowed to access this endpoint.'));
return;
Expand All @@ -33,20 +33,31 @@ export function routeRequiresAuthorization(
};
}

function isRoleMatched(permittedRole: string, userRoles: Array<RegExp>): boolean {
for (const userRole of userRoles) {
const isMatch = userRole.test(permittedRole);
if (isMatch) return true;
function isRoleMatched(permittedRole: string, userRoles: Array<Role>): boolean {
return userRoles.some((userRole) => userRole.matches(permittedRole));
}

class Role {
private roleRegex: RegExp;

private constructor(role: string) {
this.roleRegex = this.transformUserRole(role);
}

return false;
}
public static from(role: string): Role {
return new Role(role);
}

private transformUserRole(userRole: string): RegExp {
if (!userRole.includes('*')) return new RegExp(`^${userRole}$`);

function transformUserRole(userRole: string): RegExp {
if (!userRole.includes('*')) return new RegExp(`^${userRole}$`);
const regexString = userRole
.replaceAll('**', '[a-zA-Z0-9_-]+(:[a-zA-Z0-9_-]+){0,}')
.replaceAll('*', '[a-zA-Z0-9_-]+');
return new RegExp(`^${regexString}$`);
}

const regexString = userRole
.replaceAll('**', '[a-zA-Z0-9_-]+(:[a-zA-Z0-9_-]+){0,}')
.replaceAll('*', '[a-zA-Z0-9_-]+');
return new RegExp(`^${regexString}$`);
public matches(permittedRole: string): unknown {
return this.roleRegex.test(permittedRole);
}
}