如何使用nodejs实现基于角色的身份认证？

const express = require('express');
const app = express();

// 定义角色和权限
const roles = {
  admin: ['read', 'write', 'delete'],
  user: ['read']
};

// 模拟用户数据库
const users = [
  { username: 'admin', password: 'admin', role: 'admin' },
  { username: 'user', password: 'user', role: 'user' }
];

// 用户认证
function authenticate(username, password) {
  return users.find(user => user.username === username && user.password === password);
}

// 角色分配中间件
function assignRole(req, res, next) {
  const user = req.user;
  if (user) {
    req.role = user.role;
  }
  next();
}

// 路由保护中间件
function authorize(role) {
  return function(req, res, next) {
    if (req.role && roles[req.role].includes(role)) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

// 登录路由
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = authenticate(username, password);
  if (user) {
    req.user = user;
    res.send('Login successful');
  } else {
    res.status(401).send('Unauthorized');
  }
});

// 受保护的路由
app.get('/admin', assignRole, authorize('read'), (req, res) => {
  res.send('Admin dashboard');
});

app.get('/user', assignRole, authorize('read'), (req, res) => {
  res.send('User dashboard');
});

// 启动服务器
app.listen(3000, () => {
  console.log('Server started on port 3000');
});