title: Verify access/group in Passport.js
body: <p>I would like to use passport.js to verify that when users hit certain endpoints that they not only have the correct password but are a member of a specific group or have a certain access.</p>
  
  <p>For simplicity sake if I have access levels of USER and ADMIN.</p>
  
  <p>I can use passport to authenticate a password:</p>
  
  <pre><code>passport.use(new LocalStrategy(
    function(username, password, done) {
      User.findOne({ username: username }, function(err, user) {
        if (err) { return done(err); }
        if (!user) {
          return done(null, false, { message: 'Incorrect username.' });
        }
        if (!user.validPassword(password)) {
          return done(null, false, { message: 'Incorrect password.' });
        }
        return done(null, user);
      });
    }
  ));
  </code></pre>
  
  <p>Then with a route I can make sure the user passes auth:</p>
  
  <pre><code>app.get('/api/users',
    passport.authenticate('local'),
    function(req, res) {
      res.json({ ... });
    });
  </code></pre>
  
  <p>But lets say you need to have ADMIN acess to hit /api/users'.  Do I need to write my own Strategies?  IE do I need to have a local-user, and local-admin strategy, and in each verify the proper access levels?  </p>
  
  <p>I think I can do this pretty easily, but the problem arises when I need my site to have different auth methods (maybe sometimes use oauth), I would need to write custom *-user, *-admin strategies for each.  Seems like overkill.</p>
  
  <p>Other option is to just verify access/group in each route after the user has been authenticated.  But I would prefer to do this in the middle-ware if possible.</p>
  
  <p>Thanks</p>