title: In Node.js using Express, how does one have a user login along with admin login? I want users limited access with admin have access to all routes
body: <p>I built out a Node app with a user login and all the routes are protected for only users. Now I'd like to take that a step further and have one login for users and admin, but once logged in the user has access to particular routes while the admin has access to all. Here's a snippet of what I currently have:</p>
  
  <pre><code>const express = require('express');
  const app = express();
  const session = require('express-session');
  const pgSession = require('connect-pg-simple')(session);
  const bodyParser = require('body-parser');
  
  app.use(session({
      store: new pgSession({
          pgPromise: db
      }),
      secret: 'abc123',
      resave: false,
      saveUninitialized: false,
      cookie: {
          maxAge: 30 * 24 * 60 * 60 * 1000 
      }
  }));
  
  app.use(express.static('public'));
  app.use(bodyParser.urlencoded({extended: false}));
  app.use(bodyParser.json());
  
  // protected route function for all users
  function protectRoute(req, res, next) {
      let isLoggedIn = req.session.user ? true : false;
      if (isLoggedIn) {
          next();
      } else {
          res.redirect('/search')
      }
  }
  
  //middleware
  app.use((req, res, next) =&gt; {
      let isLoggedIn = req.session.user ? true : false; 
      next();
  });
  
  //login
  app.get('/login', (req, res) =&gt; {
      res.send(page(loginForm()));
  })
  
  app.post('/login', (req, res) =&gt; {
      const theUsername = req.body.username;
      const thePassword = req.body.password;
  
      User.getUserByUsername(theUsername)
          .catch(err =&gt; {
              console.log(err);
              res.redirect('/login');
          })
          .then(theUser =&gt; {
              if(theUser.password === thePassword){
                  req.session.user = theUser;
                  req.session.save(function(err){
                      res.redirect('/search');
                  });
              } else {
                  res.redirect('/login');
              }
          })
  
  })
  
  // search page for all users and admin
  app.get('/search', protectRoute, (req, res) =&gt; {
      res.send(page(companySearchForm(), req.session.user));
  });
  
  // inactive list that I WANT FOR ONLY ADMIN but currently for all users
  app.get('/inactivelist', protectRoute, (req, res) =&gt; {
      Company.getCompanyByStatus(false)
          .catch(err =&gt; {
              console.log(err);
          })
          .then(theCompany =&gt; {
              const companyInfo = inactiveList(theCompany);
              const thePage = page(companyInfo, req.session.user);
              res.send(thePage);
          })
  }) 
  </code></pre>
  
  <p>Here's the page view function that checks if loggedIn</p>
  
  <pre><code>const {logoutButton, loginOrRegister} = require('./helper');
  
  function page(content, isLoggedIn=false){
      return `
      &lt;!DOCTYPE html&gt;
      &lt;html lang="en"&gt;
      &lt;head&gt;
          &lt;meta charset="UTF-8"&gt;
          &lt;meta name="viewport" content="width=device-width, initial-scale=1.0"&gt;
          &lt;meta http-equiv="X-UA-Compatible" content="ie=edge"&gt;
  
          &lt;link rel="stylesheet" href="/stylesheets/index.css"&gt;
  
          &lt;title&gt;Document&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          ${
              isLoggedIn ? logoutButton() : loginOrRegister()
          }
          &lt;div&gt;
              ${content}
          &lt;/div&gt;
      &lt;/body&gt;
      &lt;/html&gt;
      `
  }
  
  module.exports = page;
  </code></pre>
  
  <p>So as you can see all users have access to all protected routes. How would I make that so users get access to certain paths and admins have access to all? In my PostgreSQL database there's a column on users that's admin_access boolean default 'FALSE'. Here's the database users table schema:</p>
  
  <pre><code>create table users (
      id serial primary key,
      name text,
      username text,
      password text,
      admin_access boolean default 'FALSE'
  );
  </code></pre>
  
  <p>I know it's a lot but I'd appreciate the help. No clue how admin access would work.</p>