User Access Authorization for Web Resources Im refactoring a large internal legacy application and part of the stuff I want to get rid is the  widespread code repetition. 

I'm starting with the way the website checks if a User can access a route e.g., '/admin` and which parts should be rendered or not. 

I made this little function and works pretty well but wanted to see if you could take a look into it and suggest improvements or point out problems with the way I built it.

Anyway, here's the code:

export default async function isAdmin(alias, policyOverride = null) {
    try {
        var authResult = false;
        const url = 'https://xxx.execute-api.us-west-2.amazonaws.com/local/xxxx/';

        var adminRolePolicy = ['Admin', 'Dev', 'BaseUser']; //Default Admin Policy.

        var rolesBoundToAlias = (await axios.get(url + alias)).data //Fetch roles that the alias holds.

        if(policyOverride){
            adminRolePolicy = policyOverride;
        } //If a new policy is, override the default adminRolePolicy.

        authResult = 
            rolesBoundToAlias.some(role =&gt; adminRolePolicy.includes(role)); //If alias has any of the roles in the policy grant access.

        return authResult;
    } catch (error) {
        console.error("Error when attempting to authorize user " + alias 
            + ". Access for this user has been denied, please try again."
            + "\nError: " + error);
        return false;
    }  
}


I added the policyOverride as an optional param so the function can accept an array with different roles... allowing for more flexibility.

One of the most simple applications for this function would be as follows:

import isAdmin from '../utils/authorization.js';
//Other stuff happens here.
//...
isAdmin(alias)
.then((authResult) =&gt; {
    if(authResult) {
        //Authorized to view content render this.
    }
    else {
        //Else render a 403 or something...
    }
}
If you're going to use const for some variables, then use that (or let) for all variables. Avoid var unless you have a good reason - e.g. you really need a global variable and/or hoisting.

The variable authResult can be eliminated from function isAdmin since it only gets a default value assigned, which then gets overwritten before it is returned. The function could merely return the value from the call to rolesBoundToAlias.some(). The arrow function passed to .some() could be declared on the previous line if you want, in an effort to decrease line length. Actually you might be able to just use Array.includes() bound to the array of roles instead of an extra arrow function. 

The name adminRolePolicy might be better named as DEFAULT_ROLES. I use all caps since it is more like a real constant that wouldn't change much - and could be declared outside the function if deemed appropriate. And while there is likely some overlap, Dev and BaseUser seem separate from the concept of admin.

Instead of calling the second parameter policyOverride, you could call it roles with the default of DEFAULT_ROLES - then there would be no need to assign the parameter to a different variable.