.6 API Documentation & Endpoints

Your Node.js + Express backend serves as the access control gatekeeper, checking permissions before routing users to the appropriate dashboard views.

---

Base URL

If running locally:

http://localhost:5000

If deployed (e.g., on Render, Railway, or Heroku):

https://class-guard-backend.yourdomain.com

---

Check Permission Endpoint

POST /api/check-permission

Used to validate whether a user can access a specific resource (dashboard).

Request Payload

{
  "user": "user2345",
  "resource": "admin-dashboard"
}

• user: A unique user ID (or username) that exists in Permit.io.

• resource: One of admin-dashboard, student-dashboard, or teacher-dashboard.

Response Payload

{
  "permitted": true
}

• Returns true or false based on permission logic.

Backend Logic (server.js)

app.post('/api/check-permission', async (req, res) => {
  const { user, resource } = req.body;
try {
const allowed = await permit.check(user, 'view', resource);
res.json({ permitted: allowed });
} catch (err) {
res.status(500).json({ error: 'Permission check failed' });
}
});

---

Example Usage from Frontend

const checkPermission = async () => {
  const response = await fetch("http://localhost:5000/api/check-permission", {
    method: "POST",
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      user: "user2345",
      resource: "admin-dashboard"
    })
  });
const data = await response.json();
return data.permitted;
};

---

Future Endpoints (Planned)

Endpoint	Method	Description	Auth Required
/api/login	POST	Authenticates user (optional JWT flow)
/api/register	POST	Registers new user
/api/user-role	GET	Gets a user's role from Permit.io
/api/user-dashboard-access	POST	Logs dashboard access attempt

Always wrap your permission logic in try-catch blocks and log detailed errors for easier debugging.

---

Authentication (Optional Add-on)

In the future, you can integrate JWT-based login so:

• Users login → receive token

• Token decoded to identify user ID

• That ID used for permission checks

This would remove hardcoding and allow multiple user sessions.

---