. Is there a way to allow users with ANY of the given roles to a route? For example, how should I set the validator so that users with any one of the roles
admin, subadmin, subsubadmin
are given access to a certain route?
Thank you.
r
rp_st
08/02/2023, 5:22 PM
hey @cabara in this case, you souhldn't use the validator in verifySession, but instead, add the logic in your API itself.
rp_st
08/02/2023, 5:23 PM
the docs mentions this:
Copy code
app.post("/update-blog", verifySession(), async (req: SessionRequest, res) => {
const roles = await req.session!.getClaimValue(UserRoles.UserRoleClaim);
if (roles === undefined || !roles.includes("admin")) {
// this error tells SuperTokens to return a 403 to the frontend.
throw new STError({
type: "INVALID_CLAIMS",
message: "User is not an admin",
payload: [{
id: UserRoles.UserRoleClaim.key
}]
})
}
// user is an admin..
});
SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).
