Application.js

  function require_superadmin(req, cb) {
    cb(req.user && req.user.superadmin);
  }

  function require_user(req, cb) {
    cb(req.user);
  }

  function anyone(req, cb) {
    cb(true);
  }

  function require_user_is_logged_user(req, cb) {
    cb(req.user.id == req.params.id || req.user.email == req.params.id);
  }

  function require_user_can_edit_order(req, cb) {
    // todo: 
    require_user(req, cb);
  }

  // todo: refactor with async? create library?
  var permissions = {
    account: {
      default: require_user
    },
    clients: {
      default: require_user,
      create: anyone
    },
    users: {
      default: require_user,
      index: require_superadmin,
      create: anyone,
      show: function (req, cb) {
        require_user(req, function (authorized) {
          if (!authorized) return cb(false);
          require_user_is_logged_user(function (authorized) {
            if (!authorized) {
              return require_superadmin(cb);
            }
            return cb(true);
          });
        });
      }
    },
    orders: {
      index: require_superadmin,
      create: require_user_can_edit_order,
      update: require_user_can_edit_order
    },
    users_clients: 
  };