How do I set specific roles to redirect from specific routes with Custom Claims?

Question

I am using NodeJS, Express and plain vanilla javascript/html. Not React or anything else.

With firebase I made it to when the user registers, they will automatically be called a customer (on the server-side). As shown:
server.js

app.post('/register', (req,res) => {
    let {first_name, last_name, email, uid} = req.body;

    db.collection('users').doc(uid).set(req.body)
    .then(data => {
        res.json({
            uid: req.body.uid,
            first_name: req.body.first_name,
            last_name: req.body.last_name,
            email: req.body.email,
            seller: req.body.seller
        })
    })

    admin.auth()
    .setCustomUserClaims(uid, {
        type: "customer",
    })
    .then(() => console.log('done'))
})

But now, I would like to make this route to where it will redirect if the type is a customer. if(idToken.claim.type === 'customer') {redirect('/') }

app.get('/seller', (req,res) => {
    res.sendFile(path.join(staticPath, "seller.html"));
})

So I thought, what if I were to get the Token from the user and the type as soon as they log in, and send it back to the client. This will work.
login.js

firebase.auth().currentUser.getIdTokenResult()
.then((idTokenResult) => {
    fetch('/getMyClaims', {
        method: 'post',
        headers: {'Content-Type':'application/json'},
        body: JSON.stringify({uid: user.uid,
            idToken: idTokenResult.claims.type}),
    })
    .then(() => res.json)
    .catch(err => console.log(err));
});

and now my server.js now includes:

app.post('/getMyClaims', async(req,res) => {
    let {uid,idToken} = req.body;
    admin.auth()
    .getUser(uid)
    .then((userRecord) => console.log(userRecord))
})

and this is where I get stuck, because I am trying to find out how can I call the results of '/getMyClaims' to redirect a user, if they are a customer and are trying to access the '/seller' URL. I did read the documents as given https://firebase.google.com/docs/auth/admin/custom-claims, but it does not really show how to re-route if claim has a specific type in the backend.

Mergo22 · Accepted Answer · 2022-07-14T07:34:47.067

I've figured things out after hours of this!

server.js

var block;

var blockware = (req,res,next) => {
    if(block == true || block == undefined){
        console.log("deny access", block);
        return res.sendStatus(401);
    }
    console.log("allow",block);
    next();
}

app.post('/getMyClaims', async(req,res) => {
    let {uid,idToken} = req.body;
    if(idToken === 'customer'){
        block = true;
    } else if(idToken === 'admin'){
        block = false;
    } else {
        block = true;
    }
    admin.auth()
    .getUser(uid)
    .then((userRecord) => console.log(userRecord))
})

app.get(['/seller', '/products', '/'], blockware, (req,res) => {
    res.sendFile(path.join(staticPath, ""));
})

So now if user has a customer type claim then they are blocked from accessing seller. Otherwise, admin can access seller. Even when user is logged out since it is automatically set to true, everyone will be blocked from it.

referenced this: express.js - single routing handler for multiple routes in a single line

How do I set specific roles to redirect from specific routes with Custom Claims?

1 Answers1