src/index.js
function protect_roles(app, config, prefix) {

    for (var path in config) {

        init_debug("Protecting path: " + prefix + path);

        var allow = true;
        if (config[path].action === "deny")
            allow = false;

        init_debug("Allow: " + allow);

        for (var method in config[path]) {

            init_debug("Protecting method: " + method);

            if (method != "action") {

                var config_array = config[path][method];

                app[method](prefix + path, (function (allow, conf) {

                    return function (req, resp, next) {

                        running_debug("config roles: " + conf);
                        running_debug("req roles: " + req.user.roles.toString());

                        var active_roles = _.intersection(conf, req.user.roles);

                        running_debug("active roles: " + active_roles);


                        if (active_roles.length > 0) {
                            running_debug("active roles > 0");
                            if (allow) {
                                running_debug("path allowed");

                                req.user.authorized_roles = _.union(req.user.authorized_roles, active_roles);

                            } else {
                                running_debug("path not allowed");
                                req.user.authorized_roles = _.difference(req.user.authorized_roles, active_roles);
                            }
                        }
                        next();
                    };

                })(allow, config_array));
            }
        }
    }

}
function protect_roles(app, config, prefix) {

    for (var path in config) {

        init_debug("Protecting path: " + prefix + path);

        var allow = true;
        if (config[path].action === "deny")
            allow = false;

        init_debug("Allow: " + allow);

        for (var method in config[path]) {

            init_debug("Protecting method: " + method);

            if (method != "action") {

                var config_array = config[path][method];

                app[method](prefix + path, (function (allow, conf) {

                    return function (req, resp, next) {

                        running_debug("config roles: " + conf);
                        running_debug("req roles: " + req.user.roles.toString());

                        var active_roles = _.intersection(conf, req.user.roles);

                        running_debug("active roles: " + active_roles);


                        if (active_roles.length > 0) {
                            running_debug("active roles > 0");
                            if (allow) {
                                running_debug("path allowed");

                                req.user.authorized_roles = _.union(req.user.authorized_roles, active_roles);

                            } else {
                                running_debug("path not allowed");
                                req.user.authorized_roles = _.difference(req.user.authorized_roles, active_roles);
                            }
                        }
                        next();
                    };

                })(allow, config_array));
            }
        }
    }

}
-------------------------------------- 
Install protecting routes into the app express application. Roles are defined in the config
@param   {Object} app    The expressjs application to protect with
@param   {Object} config Define the path/method/roles configuration
@param {String} The prefix string of each path to protect