page/middleware.js
function userHasAccess (item) {
       if (typeof item.isSecure !== 'boolean' || item.isSecure === false) {
           // page has no security settings or false, let user pass
           return true;
       } else {
           // page is secured, check if user has access
           var pageRoles = item.roles;
           debug('pageRoles', item.title, pageRoles)

           if (Array.isArray(pageRoles) && pageRoles.length === 0) {
               // page is secured, but requires no specific role
               if (req.session.user) {
                   // user is authenticated, let pass
                   return true;
               } else {
                   // user is not authenticated, reject
                   return false
               }
           }

           if (!req.session.user || !req.session.user.roleIds) {
               // user session does not exist, skip
               return false;
           }

           // make sure roleIds are strings (on first request they are objects)
           var userRoles = [];
           var sessionRoleIds = req.session.user.roleIds;
           for (var r in sessionRoleIds) {
               userRoles.push(sessionRoleIds[r].toString());
           }

           // compare required roles and user roles
           for (var r in pageRoles) {
               var pageRoleId = pageRoles[r].toString();
               if (userRoles.indexOf(pageRoleId) !== -1) {
                   // user has role, let pass
                   return true;
               }
           }
       }
       // all pass rules failed, reject user
       return false;
   }
function userHasAccess (item) {
       if (typeof item.isSecure !== 'boolean' || item.isSecure === false) {
           // page has no security settings or false, let user pass
           return true;
       } else {
           // page is secured, check if user has access
           var pageRoles = item.roles;
           debug('pageRoles', item.title, pageRoles)

           if (Array.isArray(pageRoles) && pageRoles.length === 0) {
               // page is secured, but requires no specific role
               if (req.session.user) {
                   // user is authenticated, let pass
                   return true;
               } else {
                   // user is not authenticated, reject
                   return false
               }
           }

           if (!req.session.user || !req.session.user.roleIds) {
               // user session does not exist, skip
               return false;
           }

           // make sure roleIds are strings (on first request they are objects)
           var userRoles = [];
           var sessionRoleIds = req.session.user.roleIds;
           for (var r in sessionRoleIds) {
               userRoles.push(sessionRoleIds[r].toString());
           }

           // compare required roles and user roles
           for (var r in pageRoles) {
               var pageRoleId = pageRoles[r].toString();
               if (userRoles.indexOf(pageRoleId) !== -1) {
                   // user has role, let pass
                   return true;
               }
           }
       }
       // all pass rules failed, reject user
       return false;
   }
Returns true if user is allowed to see page