How to Build a User permission management with Replit

A practical way to build a user permission management system on Replit is to create a Node.js + Express backend with authentication (using hashed passwords and JWT tokens) and a simple middleware that checks user roles (like “admin”, “editor”, “viewer”). You’ll store user data and their roles in a database (for Replit demos, SQLite works great and is included by default). Then, you add API routes that only certain roles can access. This approach works well on Replit and is easy to deploy, test, and extend — it’s also safe to use with Replit Secrets for environment variables.

 

Set up your structure

 

Create the following files and folders in your Replit project root:

• index.js – Your main server file (Express app setup)
• db.js – Handles SQLite connection
• auth.js – Contains login/signup logic and JWT generation
• middleware/permission.js – Middleware to check if the user has the required role

Also, go to the “Secrets” tab in Replit and create a new secret called JWT\_SECRET with any secure random string (this will keep JWT signing safe).

 

Install dependencies

 

npm init -y
npm install express sqlite3 bcryptjs jsonwebtoken

 

Create db.js

 

// db.js
const sqlite3 = require('sqlite3').verbose();

const db = new sqlite3.Database(':memory:'); // for demo, use in-memory; or './users.db' for a file

// Create users table with name, password and role
db.serialize(() => {
  db.run('CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, username TEXT, password TEXT, role TEXT)');
});

module.exports = db;

 

Create auth.js

 

// auth.js
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');
const db = require('./db');

const JWT_SECRET = process.env.JWT_SECRET;

// Register new user
function register(username, password, role, callback) {
  bcrypt.hash(password, 10, (err, hash) => {
    if (err) return callback(err);
    db.run(
      'INSERT INTO users (username, password, role) VALUES (?, ?, ?)',
      [username, hash, role],
      function (dbErr) {
        if (dbErr) return callback(dbErr);
        callback(null, { id: this.lastID, username, role });
      }
    );
  });
}

// Login existing user
function login(username, password, callback) {
  db.get('SELECT * FROM users WHERE username = ?', [username], (err, user) => {
    if (err || !user) return callback(err || new Error('User not found'));
    bcrypt.compare(password, user.password, (compErr, isMatch) => {
      if (!isMatch) return callback(new Error('Invalid password'));
      const token = jwt.sign(
        { id: user.id, username: user.username, role: user.role },
        JWT_SECRET,
        { expiresIn: '1h' }
      );
      callback(null, token);
    });
  });
}

module.exports = { register, login };

 

Create middleware/permission.js

 

// middleware/permission.js
const jwt = require('jsonwebtoken');
const JWT_SECRET = process.env.JWT_SECRET;

function authorizeRole(allowedRoles) {
  return (req, res, next) => {
    const authHeader = req.headers.authorization;
    if (!authHeader) return res.status(403).json({ message: 'No token provided' });
    const token = authHeader.split(' ')[1];
    jwt.verify(token, JWT_SECRET, (err, decoded) => {
      if (err) return res.status(403).json({ message: 'Invalid token' });
      if (!allowedRoles.includes(decoded.role)) {
        return res.status(403).json({ message: 'Permission denied' });
      }
      req.user = decoded;
      next();
    });
  };
}

module.exports = authorizeRole;

 

Create the main server index.js

 

// index.js
const express = require('express');
const app = express();
const db = require('./db');
const { register, login } = require('./auth');
const authorizeRole = require('./middleware/permission');

app.use(express.json());

// Endpoint to register new user
app.post('/register', (req, res) => {
  const { username, password, role } = req.body;
  register(username, password, role, (err, user) => {
    if (err) return res.status(400).json({ error: err.message });
    res.json({ message: 'User registered', user });
  });
});

// Endpoint to login
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  login(username, password, (err, token) => {
    if (err) return res.status(400).json({ error: err.message });
    res.json({ token });
  });
});

// Protected route for admin only
app.get('/admin', authorizeRole(['admin']), (req, res) => {
  res.json({ message: `Welcome, ${req.user.username}! You have admin access.` });
});

// Protected route for editors and admins
app.get('/editor', authorizeRole(['admin', 'editor']), (req, res) => {
  res.json({ message: `Hello ${req.user.username}, you can edit content.` });
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

 

How to run and test it on Replit

 

• Press the green “Run” button — Replit will start your server on a visible URL.
• Use the “Shell” or Replit’s built-in “HTTP client” tab to test endpoints.
• POST to /register with JSON like:

  {"username":"alice","password":"1234","role":"admin"}

• POST to /login to get a JWT token.
• Use that token as Authorization header (Bearer <token>) when calling /admin or /editor.

 

Replit-specific tips

 

• Secrets: use them to store JWT\_SECRET or DB connection strings instead of hardcoding.
• Persistence: the in-memory DB resets when the repl restarts. To persist, change ':memory:' to './users.db'.
• Logs: use Replit’s console to debug output; add console.log() statements if you need to trace requests.
• Collaboration: other team members can join the repl in “multiplayer” mode and see code changes live.

 

That’s a complete runnable user permission management setup that fits Replit’s environment perfectly — simple to maintain, test, and safe to deploy for demos or small projects.

When building a user permission management system in Replit, keep the logic simple and structured. Use role-based access control (RBAC) or permission-based checks stored in a database (like Replit’s built-in Database or an external one such as MongoDB Atlas). Store credentials and JWT secrets using the Replit Secrets tool, not in your code. Your main backend file (e.g., index.js for Node or main.py for Python) should handle routes, authentication, and role validations. Keep permission logic modular, like in a separate auth.js middleware or permissions.js helper.

 

Folder Structure and Setup

 

Organize your files clearly inside your Replit project so permissions and authentication are readable and manageable.

• index.js — main server entry.
• auth.js — middleware for verifying login and roles.
• permissions.js — helper defining allowed actions by role.
• .env (Replit Secrets) — define your JWT secret or API keys using Replit’s “Secrets” panel, not plaintext.

 

Step 1: Basic Express Server (index.js)

 

// index.js
import express from "express";
import jwt from "jsonwebtoken";
import { checkRole } from "./auth.js";

const app = express();
app.use(express.json());

// Example users stored in memory for demo
const users = [
  { id: 1, username: "adminUser", role: "admin" },
  { id: 2, username: "editorUser", role: "editor" },
  { id: 3, username: "viewerUser", role: "viewer" }
];

// Generate token route
app.post("/login", (req, res) => {
  const { username } = req.body;
  const user = users.find(u => u.username === username);
  if (!user) return res.status(403).send("Invalid username");
  
  // Secret stored in Replit Secrets panel as JWT_SECRET
  const token = jwt.sign({ id: user.id, role: user.role }, process.env.JWT_SECRET);
  res.json({ token });
});

// A route restricted by role
app.get("/admin-data", checkRole("admin"), (req, res) => {
  res.send("Secure admin data here");
});

// Start the server
app.listen(3000, () => console.log("Server running on port 3000"));

 

Step 2: Create Middleware (auth.js)

 

This file verifies tokens and checks if the user’s role fits the route requirement. Create auth.js in the root of your Replit project.

// auth.js
import jwt from "jsonwebtoken";

export function checkRole(requiredRole) {
  return (req, res, next) => {
    const authHeader = req.headers.authorization;
    if (!authHeader) return res.status(401).send("No token provided");

    const token = authHeader.split(" ")[1];
    try {
      const decoded = jwt.verify(token, process.env.JWT_SECRET);
      if (decoded.role !== requiredRole) {
        return res.status(403).send("Insufficient permissions");
      }
      req.user = decoded;
      next();
    } catch (err) {
      res.status(401).send("Invalid token");
    }
  };
}

 

Step 3: Define Permission Matrix (permissions.js)

 

You can extend roles and permissions easily from here. For complex projects, store these in a database table.

// permissions.js
export const rolesPermissions = {
  admin: ["read", "write", "delete"],
  editor: ["read", "write"],
  viewer: ["read"]
};

// Helper to verify a user's action
export function can(role, action) {
  return rolesPermissions[role]?.includes(action);
}

 

Step 4: Storing Secrets Properly

 

Never hardcode secrets directly in code. In Replit:

• Go to the padlock icon (Secrets panel) in the left sidebar.
• Set Key = JWT\_SECRET and Value = any long random string.
• Your code will access it via process.env.JWT\_SECRET.

 

Step 5: Using Databases in Replit (if needed)

 

If you need persistent user data, connect Replit DB or MongoDB:

// Example using Replit DB for simple user storage
import Database from "@replit/database";
const db = new Database();

await db.set("users", users);
const storedUsers = await db.get("users");

 

Practical Replit Tips

 

• Use the "Always On" feature (if available) to keep your permission system active for API routes.
• Keep private data (like JWT secrets) in Secrets. Anyone with Editor access to the Repl can see environment variables, so never store passwords there directly.
• Use Git integration to version control permission logic changes.
• Test endpoints directly in the Replit shell using curl or in-built browser tab.

 

This setup is minimal but production-valid in Replit’s sandbox. It keeps authentication and permission checks modular, secrets secure, and logic easy to extend — matching how a senior developer would structure Node-based projects inside Replit’s environment.