User Role Management

const userSchema= new Schema({
  role: String, // 'admin', 'librarian', 'member'
});

  // আগে verify টোকেন middleware এমন ছিল 
  try {
    const decoded = jwt.verify(token, '123456789');
    req.user = decoded; // Store the decoded user data in req.user
    next();
  } catch (error) {
    res.status(400).json({ message: 'Invalid token' });
  }
  
  
  
  
 // পরিবর্তন করে নিচের মতো করবো 
  
    try {
    const decoded = jwt.verify(token, '123456789');
    req.user = decoded; // Store the decoded user data in req.user

    // Fetch the user's role from the database and add it to req.user
    User.findById(decoded._id, 'role', (err, user) => {
      if (err) {
        return res.status(500).json({ message: 'Error fetching user data.' });
      }
      req.user.role = user.role; // Add the user's role to req.user
      next();
    });
  } catch (error) {
    res.status(400).json({ message: 'Invalid token' });
  }
  
  

function isAdmin(req, res, next) {
    if (req.user && req.user.role === 'admin') {
      return next();
    }
    return res.status(403).json({ message: 'Access denied. Admin privileges required.' });
  }
  
  function isLibrarian(req, res, next) {
    if (req.user && (req.user.role === 'admin' || req.user.role === 'librarian')) {
      return next();
    }
    return res.status(403).json({ message: 'Access denied. Librarian or admin privileges required.' });
  }
  
  function isMember(req, res, next) {
    if (req.user && (req.user.role === 'admin' || req.user.role === 'librarian' || req.user.role === 'member')) {
      return next();
    }
    return res.status(403).json({ message: 'Access denied. Member, librarian, or admin privileges required.' });
  }

  

module.exports = {verifyToken,isAdmin,isLibrarian,isMember};

const {verifyToken,isAdmin,isLibrarian,isMember} = require('./middleware');
// Example protected routes with role-based access control

router.get('/api/protected', verifyToken, (req, res) => {
  res.json({ message: 'This is a protected route.' });
});

// Example protected routes with role-based access control
router.get('/api/admin', verifyToken, isAdmin, (req, res) => {
  res.json({ message: 'This is an admin-only route.' });
});

router.get('/api/librarian', verifyToken, isLibrarian, (req, res) => {
  res.json({ message: 'This is a librarian or admin route.' });
});

router.get('/api/member', verifyToken, isMember, (req, res) => {
  res.json({ message: 'This is a member, librarian, or admin route.' });
});