Role.ts (App/Middleware) | kernel.ts (start)

kernel.ts

/*
|--------------------------------------------------------------------------
| Application middleware
|--------------------------------------------------------------------------
|
| This file is used to define middleware for HTTP requests. You can register
| middleware as a `closure` or an IoC container binding. The bindings are
| preferred, since they keep this file clean.
|
*/

import Server from '@ioc:Adonis/Core/Server'

/*
|--------------------------------------------------------------------------
| Global middleware
|--------------------------------------------------------------------------
|
| An array of global middleware, that will be executed in the order they
| are defined for every HTTP requests.
|
*/
Server.middleware.register([
  () => import('@ioc:Adonis/Core/BodyParser'),
])

/*
|--------------------------------------------------------------------------
| Named middleware
|--------------------------------------------------------------------------
|
| Named middleware are defined as key-value pair. The value is the namespace
| or middleware function and key is the alias. Later you can use these
| alias on individual routes. For example:
|
| { auth: () => import('App/Middleware/Auth') }
|
| and then use it as follows
|
| Route.get('dashboard', 'UserController.dashboard').middleware('auth')
|
*/
Server.middleware.registerNamed({
  auth: () => import('App/Middleware/Auth'),
  role: () => import('App/Middleware/Role'),
})

Role.ts

import type { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import AuthException from 'App/Exceptions/AuthException'
import AccountService from 'App/Services/User/AccountService'

export default class Role {
  service = new AccountService()
  public async handle({ auth }: HttpContextContract, next: () => Promise<void>, rule) {
    const roles = rule
    if (roles.length == 0) {
      await next()
    } else {
      try {
        const token = await auth.use('api').authenticate()
        const user = await this.service.find(token.id)
        await user.load('role');
        const result = JSON.parse(JSON.stringify(user))
        const role_code = result.role.code
        if(roles.includes(role_code)){
          await next()
        } else {
          throw new AuthException('Forbidden!', 403, 'E_FORBIDDEN_ACCESS')
        }
      } catch (e) {
        throw new AuthException('Forbidden!', 403, 'E_FORBIDDEN_ACCESS')
      }
    }
  }
}