Feature Request - add method in our api to validate userRole for secure route for frontend.

[PurnenduMIshra129th]

Is your feature request related to a problem? Please describe.
-Currently for frontend application there is no authentication for routing from server side. Means a normally user can access the unauthorized pages by changing the url in it . Which is an issue. Because it is used to use the token from frontend stored in localstorage.

• Which can be easily tampered.And it is not a secure way for routing.

Describe the solution you'd like
-My solution is to create query in server for validating token. For each pages visited by user it should make an api call to server with an token in its header.

-Server will take the token from its header then verify if user is authorized or not by checking its role from AppUserProfile and if the token is valid or not .

-If the token validate then in response it will send in respone as user:authorized and role:admin or superAdmin or user.

-If not then it will send in respone user:unauthorized and role:""

-By using this response frontend will use this in its routing . Let take an example a user will access the url via url but he/she is user but trying to access the superAdmin page . As it is validating through server he will not be able to access.

Describe alternatives you've considered
N/A

Approach to be followed (optional)
N/A

Additional context
-It is user for our issue opened on frontend issue number #1839 . Secured Route / Auth wall #1839 see this one in talawa-admin.

Potential internship candidates

Please read this if you are planning to apply for a Palisadoes Foundation internship

• Student Internship Programs talawa#359

[bandhan-majumder]

I asked the same on slack few days ago. Did not get any response.

[PurnenduMIshra129th]

Lets see

[pratikravindramane]

Love to Do it
I will first set an authMiddleware in the Middleware folder to check if the requested person has a valid token or not
then after that I will check if it's isSuperAdmin is true or not.
from not we are able to identify it's a user or a super Admin
What are your Thoughts? @PurnenduMIshra129th

[PurnenduMIshra129th]

@pratikravindramane try to implement with proper structure other wise your code will not be able to merge. I am not mentor ask @Cioppolo14 or @palisadoes to assign.