jwt-middleware-auth 2.1.3 → 2.1.4

package/index.js

@@ -364,6 +364,50 @@ function canModifyConfirmed(user) {
 	return ['admin', 'SuperManager', 'manager'].includes(user.role);
 }
 
+/**
+ * Custom middleware that verifies either ownership OR admin/manager roles
+ * Allows product owner OR users with manager, SuperManager, admin roles to perform actions
+ * @param {string} secret - JWT secret key
+ * @param {Function} getOwnerIdFn - Function to get the resource owner ID
+ * @returns {Function} Express middleware function
+ */
+const verifyOwnershipOrAdminRoles = (secret, getOwnerIdFn) => {
+	return async (req, res, next) => {
+		try {
+			const token = req.headers['token'];
+			if (!token) {
+				return res.status(401).json({ error: 'Access denied. No token provided.' });
+			}
+
+			const decoded = jwt.verify(token, secret);
+			req.user = decoded;
+
+			// Check if user has admin roles
+			const adminRoles = ['manager', 'SuperManager', 'admin'];
+			if (adminRoles.includes(decoded.role)) {
+				return next();
+			}
+
+			// Check ownership
+			const ownerId = await getOwnerIdFn(req);
+			if (decoded.id !== ownerId.toString()) {
+				return res.status(403).json({ error: 'Access denied. You do not have permission to perform this action.' });
+			}
+
+			next();
+		} catch (error) {
+			if (error.name === 'JsonWebTokenError') {
+				return res.status(401).json({ error: 'Invalid token.' });
+			}
+			if (error.name === 'TokenExpiredError') {
+				return res.status(401).json({ error: 'Token expired.' });
+			}
+			res.status(500).json({ error: error.message });
+		}
+	};
+};
+
+
 module.exports = { 
   verifyToken, 
   authorizeRoles,
@@ -378,5 +422,6 @@ module.exports = {
   verifyAdmin, 
   verifyTokenAndAuthorization, 
   verifyManager,
-  canModifyConfirmed
+  canModifyConfirmed,
+  verifyOwnershipOrAdminRoles
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jwt-middleware-auth",
-  "version": "2.1.3",
+  "version": "2.1.4",
   "description": "A comprehensive middleware library for JWT authentication and role-based authorization in Express.js",
   "main": "index.js",
   "scripts": {