Node.js the Right Way

Authorizing APIs with Custom Middleware

With passport’s Google strategy set up and Redis configured to store session information, we’re in position to develop some protected user APIs. Unlike the book and bundle APIs we developed in the last chapter, these APIs will provide access to information specifically for logged-in users.

Here are the endpoints we’ll create, and the HTTP verbs they’ll support. They all return JavaScript Object Notation (JSON):

• /api/user (GET)—Basic information about the user (like the user’s identifier)

• /api/user/bundles (GET)—Object that maps bundle IDs to bundle names

• /api/user/bundles (PUT)—Overwrites the bundle mapping object with the provided JSON body

Implementing these APIs will give us a chance ...