الصلاحيات (Authorization)

function requireRole(role) {
  return (req, res, next) => {
    if (req.user.role !== role) {
      return res.status(403).json({ error: "ممنوع" });
    }
    next();
  };
}

app.delete("/users/:id", auth, requireRole("admin"), deleteUser);

app.patch("/posts/:id", auth, async (req, res) => {
  const post = await getPost(req.params.id);
  if (post.authorId !== req.user.userId) {
    return res.status(403).json({ error: "ليست منشوراتك" });
  }
  // ... التحديث
});