title: How to handle authorization in a layered nodejs with passport app?
body: <p>So I'm trying to build an app with nodejs, using express and passport, but as I try to do some kind of TDD, I want to decouple bussiness logic from controllers.</p>
  
  <p>So I have a common scenario like this:</p>
  
  <ul>
  <li><p>An authenticated user wants to delete an item, he sends a request to the api:</p>
  
  <p><code>DELETE /api/item/1</code></p></li>
  <li><p>The request is handled by the controller method, which passes the user that makes the request to the next layer (<strong>which doesn't seem like a good approach</strong>):</p>
  
  <p><code>exports.delete = function (req, res, next) {
    var itemId = req.params.id;
    var userId = req.user._id;
    itemService.delete(itemId, userId, function (err, item) {
      if (err) next(err);
      return res.json(item);
    });
  };</code></p></li>
  <li><p>The service layer (or whatever you want to call it, the layer that has all the bussiness logic) then checks if the item is owned by that user, and then deletes it or returns an error otherwise.</p></li>
  </ul>
  
  <p>So I was wondering if there is any way to get the current user from any layer without passing it from the controller.</p>