procademy
25 minutes
Writing a requireRole Guard for Admin-Only Routes
Once identity is established, a second small middleware checks whether that user's role is on a list this route allows, and refuses otherwise. Keeping it separate from the identity guard means the two failures stay distinguishable: not signed in is a different answer from signed in but not permitted. The list of who may do what then lives beside the route, where a reviewer can read it.