app.get('/user/:id', function (req, res) {
    req.token.require
        .role('admin')
        .or.claim('user_id', req.params.id)
        .guard()    

    res.send('You are allowed to access this user!')
})

import express from 'express'
import jwtGuard from 'jwt-guard'

const app = express()

app.use(jwtGuard('secret_key_shhhhh'))

app.get('/admin-area', function (req, res) {
    req.token.require.role('admin').guard()
    
    res.send('Welcome to the secret area')
})

app.post('/user', function (req, res) {
    const userId = req.body.user_id

    req.token.require.claim('user_id', user_id)
        .guard('Sorry you can only update your own account.')

    // passed, update logic here
})

app.post('/blog', function (req, res) {
    req.token.require
        .role('blog:post')
        .or.role('blog:admin')
        .or.role('god')
        .guard()
    
    // passed, post the blog
})

app.delete('/blog/:id', function (req, res) {
    const blogPost = '...'

    req.token.require
        .role('admin')
        .or.claim('user_id', blogPost.ownerUserId)
        .and.role('blog:delete')
        .guard()
    
    // passed, delete the blog
})

app.get('/admin-area', function (req, res) {
    const isAdmin = req.token.require.role('admin').check
    
    if(isAdmin) {
        res.send('Welcome to the secret area')
    } else{
        res.redirect('/')
    }
})

app.get('/', function (req, res) {
    const name = req.token.claims.name
    
    res.send(`Hello ${name}`)
})