How to Build Secure Node.js APIs with JWT & Role-Based Access

const jwt = require('jsonwebtoken');

function generateToken(user, workspace) {
  const payload = {
    sub:         user.id,
    email:       user.email,
    workspaceId: workspace.id,
    role:        workspace.userRole,   // 'admin' | 'member' | 'guest'
    plan:        workspace.plan,       // 'free' | 'pro' | 'enterprise'
    iat:         Math.floor(Date.now() / 1000),
  };

  return jwt.sign(payload, process.env.JWT_SECRET, {
    expiresIn: '15m',        // keep access tokens SHORT
    algorithm: 'HS256',
  });
}

const jwt = require('jsonwebtoken');

// Step 1 — Verify the token is real and not expired
const verifyToken = (req, res, next) => {
  const auth = req.headers.authorization;
  if (!auth?.startsWith('Bearer '))
    return res.status(401).json({ error: 'Missing token' });

  try {
    req.user = jwt.verify(auth.slice(7), process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: 'Invalid or expired token' });
  }
};

// Step 2 — Check the user's role against what's allowed
const authorise = (...allowedRoles) => (req, res, next) => {
  if (!allowedRoles.includes(req.user.role))
    return res.status(403).json({ error: 'Insufficient permissions' });
  next();
};

module.exports = { verifyToken, authorise };

const { verifyToken, authorise } = require('../middleware/auth');

// Any logged-in user can browse
router.get('/browse', verifyToken, contentController.browse);

// Only creators and admins can upload
router.post('/upload', verifyToken, authorise('creator', 'admin'), contentController.upload);

// Admins only
router.delete('/content/:id', verifyToken, authorise('admin'), contentController.remove);

const crypto = require('crypto');

function issueTokenPair(user, res) {
  // Short-lived access token in response body
  const accessToken = jwt.sign(
    { sub: user.id, role: user.role },
    process.env.JWT_ACCESS_SECRET,
    { expiresIn: '15m' }
  );

  // Long-lived refresh token — httpOnly cookie only
  const refreshToken = crypto.randomBytes(64).toString('hex');

  res.cookie('refreshToken', refreshToken, {
    httpOnly: true,    // JS cannot read this
    secure:   true,    // HTTPS only
    sameSite: 'strict',
    maxAge:   7 * 24 * 60 * 60 * 1000,  // 7 days
  });

  // Store hashed refresh token in DB
  const hash = crypto.createHash('sha256').update(refreshToken).digest('hex');
  await db.refreshTokens.create({ userId: user.id, tokenHash: hash });

  return { accessToken };
}

router.post('/refresh', async (req, res) => {
  const token = req.cookies.refreshToken;
  if (!token) return res.status(401).json({ error: 'No refresh token' });

  const hash = crypto.createHash('sha256').update(token).digest('hex');
  const stored = await db.refreshTokens.findOne({ tokenHash: hash });

  if (!stored || stored.used)
    return res.status(401).json({ error: 'Invalid or reused token' });

  // Invalidate old token before issuing a new one
  await db.refreshTokens.update({ tokenHash: hash }, { used: true });

  const user = await db.users.findById(stored.userId);
  return issueTokenPair(user, res);
});

// WRONG — Any authenticated user can read any invoice
const invoice = await Invoice.findById(req.params.id);

// RIGHT — Scope to the requesting merchant always
const invoice = await Invoice.findOne({
  _id:        req.params.id,
  merchantId: req.user.sub,   // from the verified JWT
});

if (!invoice) return res.status(404).json({ error: 'Not found' });