title: Express restrict routes to user roles
body: <p>I am creating a nodejs &amp; express with mongoDB application that requires a company and a user to register, when you fill a registration form, it will as if you are a company or just a normal user.</p>
  
  <p>A model for that is </p>
  
  <pre><code>iscompany: {
      type: Boolean,
      default: false,
  },
  </code></pre>
  
  <p>I created a middleware to check if the person is a company, and this is the middleware</p>
  
  <pre><code>module.exports = function(req, res, next) {
      if (!req.user.iscompany) {
        return res.status(401).json({
            msg: "you should be a company to access this. authorization denied",
        });
      }
  
      next();
  };
  </code></pre>
  
  <p>then i imported the middleware in the routes i wanna use it on, and this is the code.</p>
  
  <pre><code>const role = require("../../middleware/role");
  const User = require("../../models/User");
  const Company = require("../../models/Company");
  const { check, validationResult } = require("express-validator");
  
  //@route GET api/company/me
  //@desc get current users profile
  //access Private
  router.get("/me", auth, role, async(req, res) =&gt; {
      try {
          const company = await Company.findOne({
              user: req.user.id,
          }).populate("user", ["avatar", "fullname"]);
          if (!company) {
              res.status(400).json({
                  msg: "no company found",
              });
          }
          res.json(company);
      } catch (e) {
          console.error(e.message);
          res.status(400).send("server error");
      }
  });
  </code></pre>
  
  <p>I don't understand what when wrong, it's allowing both companies and non-companies to access the route.</p>
  
  <p>Any help?</p>