How to create access controls in express/mongoose <p>I have my project in expressjs and Mongoose(with mongodb). I have multiple roles of users - admin, manager, user</p> <p>I want few fields of each table to be accessible by manager while others not. by default user would not have any edit access, admin would have full access. One way is to make this controls in each controller function by looking at the role of user. Is there any easy way of doing it such as checking if the user has controls before saving once for each table so as to avoid duplication of business logic.</p> <p>My ordersschema is as follows. I dont want customer info to be adited without admin permission.</p> <pre><code>var OrderSchema = new Schema({ order_type: { type: String, trim: true }, customer_phone: { type: String, trim: true } }); var managerAccess = [order_type]; </code></pre> <p>My user model is as follows(more fields not added)</p> <pre><code>var UserSchema = new Schema({ firstName: { type: String, trim: true, default: '', validate: [validateLocalStrategyProperty, 'Please fill in your first name'] }, roles: { type: [{ type: String, enum: ['user', 'admin'] }], default: ['user'] }, }) </code></pre>