未授权删除 CRUD

CRUD"/>

未授权删除 CRUD

我正在尝试创建一个功能，用户可以删除他们创建的费用，或者经理可以删除他们创建的费用，但是在尝试删除我刚刚创建的费用时出现未授权错误

费用控制器删除

export const deleteExpense = async (req, res, next) => {
  try {
    const expense = await Expense.findById(req.params.id);
    if (!expense) return error404(req, res, next);

    // Retrieve the user making the request
    const requestingUser = await User.findById(req.userId);
    if (!requestingUser) return error404(req, res, next);

    // Check if the user is authorized to delete the expense
    if (req.userId !== expense.userID && requestingUser.role !== "manager")
      return error403(req, res, next);

    const deletedExpense = await Expense.findByIdAndDelete(req.params.id);

    if (!deletedExpense) return res.status(404).send("House not found");
    res.status(200).json({ message: "deleted" });
  } catch (error) {
    errorServer(error, req, res, next);
  }
};

jwt 中间件

import jwt from "jsonwebtoken";
import createError from "http-errors";

export const verifyToken = (req, res, next) => {
  const token = req.cookies.accessToken;

  if (!token) return next(createError(401, "You are not authenticated!"));

  jwt.verify(token, process.env.JWT_KEY, async (err, payload) => {
    if (err) return next(createError(403, "Token is not valid!"));

    req.userId = payload.id;
    req.role = payload.role;

    next();
  });
};