What approaches do you use to generate a template with different access rights?

Question

JavaScript

How clumsy is the data? Is this solution safe?

1. There are several tables in the database with levels and access rights (Access Control List), respectively, we get a combined access key;
   
2. We use express-session to store information about the user, name / access key, etc .;
   
3. In the required routes, we pass this key res.render('index', key : session.key});
   
4. We form the template based on the received key and give it to the user.
   

Answer 1

In fact, by default, the "key" of the user's role is written to res.locals in the request handler, and the template itself provides options for different roles, which - depending on the role (access rights) - are given for generation based on a simple check like if ( key == 'Admin')...
Actually, this is the same as res.render('index', {key : session.key}); , only "correct".