Anish Varshney

// RBAC Authorization Middleware
const checkPermission = async (req, res, next) => {
  const { userId, resource, action } = req.body;
  
  const userRole = await db.query(`
    SELECT r.permissions FROM roles r
    JOIN user_roles ur ON ur.role_id = r.id
    WHERE ur.user_id = $1
  `, [userId]);

  const hasPermission = userRole.rows[0]
    ?.permissions[resource]
    ?.includes(action);

  if (!hasPermission) {
    return res.status(403).json({ 
      error: 'Insufficient permissions' 
    });
  }
  
  next();
};