Build HTTP APIs with routing, middleware, validation, controllers, and error handling.
Lessons
Restrict routes by user role and permission.
Role-Based Access Control is easiest to learn by reading the example, changing it, and observing the result.
import express from 'express';
const app = express();
function requireRole(role) {
return (req, res, next) => {
if (req.user?.role !== role) {
return res.status(403).json({ message: 'Forbidden' });
}
next();
};
}
app.delete('/api/lessons/:id', requireRole('admin'), (req, res) => {
res.status(204).end();
});
app.listen(3000);Practice the Role-Based Access Control example in a small scratch file, then explain what changed and why.