How to Implement Role-Based Access Control in a Node.js REST API with JWT

The first time I built an API without thinking about roles, I gave every logged-in user the same access. It worked fine until a regular user accidentally hit a delete endpoint and wiped test data. Tha