基于角色过滤Express+MongoDB返回前端的JSON数据方案问询

Hey, great question! Your current setup gets the job done, but it's going to become a maintenance headache as you add more roles or user fields. Here are a few practical patterns and approaches to handle dynamic response filtering without duplicating routes:

1. Response Filter Middleware #

This is the simplest, most straightforward approach. Fetch the full user data first, then use a middleware to strip out fields based on the user's role before sending the response.

How to implement: #

• Keep a single route that fetches the complete user document
• Add a custom middleware that modifies the response based on the authenticated user's role

// Single unified route
router.get('/user/:id', signedInCheck, getUser, filterUserByRole);

// Controller to fetch full user data
async function getUser(req, res, next) {
  try {
    const user = await UserDB.findById(req.params.id);
    res.locals.user = user; // Store user data in res.locals for the next middleware
    next();
  } catch (err) {
    next(err); // Pass errors to error-handling middleware
  }
}

// Middleware to filter response by role
function filterUserByRole(req, res) {
  const user = res.locals.user.toObject(); // Convert Mongoose doc to plain JS object
  const userRole = req.user.role; // Assume role is available on req.user after auth

  switch(userRole) {
    case 'employee':
      delete user.finished_projects; // Remove sensitive/irrelevant field
      break;
    // Add new roles here as needed
    // case 'manager':
    //   delete user.it_skill;
    //   break;
    case 'admin':
    default:
      // Admin gets all fields, no filtering needed
      break;
  }

  res.json(user);
}

2. Dynamic MongoDB Projection #

If you want to avoid fetching unnecessary data from the database (good for performance with large fields), you can generate projection parameters dynamically based on the user's role.

How to implement: #

• Define a map of roles to MongoDB projection strings
• Use that map to fetch only the fields the role should see

// Define role-to-projection mapping
const roleProjections = {
  admin: '', // Empty string = fetch all fields
  employee: '-finished_projects', // Minus sign = exclude this field
  // Add more roles here
  // manager: '-it_skill -finished_projects'
};

// Single route with dynamic projection
router.get('/user/:id', signedInCheck, async (req, res) => {
  const userRole = req.user.role;
  // Fallback to admin projection if role isn't defined
  const projection = roleProjections[userRole] || roleProjections.admin;

  try {
    const user = await UserDB.findById(req.params.id, projection);
    res.json(user);
  } catch (err) {
    res.status(500).json({ error: 'Failed to fetch user' });
  }
});

3. DTO (Data Transfer Object) Pattern #

For more complex scenarios where you need to transform data (not just remove fields), use DTOs to map database models to role-specific response formats. This keeps your data transformation logic organized and reusable.

How to implement: #

• Create DTO functions/classes for each role that transform the user document
• Use a helper function to select the right DTO based on the user's role

// DTO for admin users (full data)
function toAdminUserDTO(user) {
  return {
    name: user.name,
    it_skill: user.it_skill,
    current_project: user.current_project,
    finished_projects: user.finished_projects
  };
}

// DTO for employees (excludes finished_projects)
function toEmployeeUserDTO(user) {
  const adminDTO = toAdminUserDTO(user);
  delete adminDTO.finished_projects;
  return adminDTO;
}

// Helper to get the right DTO for the role
function getUserDTO(user, role) {
  switch(role) {
    case 'employee':
      return toEmployeeUserDTO(user);
    case 'admin':
    default:
      return toAdminUserDTO(user);
  }
}

// Single route using DTOs
router.get('/user/:id', signedInCheck, async (req, res) => {
  try {
    const user = await UserDB.findById(req.params.id);
    const userDTO = getUserDTO(user, req.user.role);
    res.json(userDTO);
  } catch (err) {
    res.status(500).json({ error: 'Failed to fetch user' });
  }
});

Which one should you choose? #

• Response Middleware: Best for simple field removal, minimal setup
• Dynamic Projection: Better for performance if you don't need excluded fields at all
• DTO Pattern: Ideal for complex data transformations or when you need strict control over response formats

All of these approaches let you keep a single route, so you won't have to duplicate code every time you add a new role or field.

内容的提问来源于stack exchange，提问作者Gleb S