For your middleware to handle both Super Admin and Site Admin permissions dynamically, you can do something like:

Updated Middleware:

const authorizeRoles = (permissions: string[]) => {
    return async (req: Request, res: Response, next: NextFunction) => {
        try {
            // Check if the user object exists in the request
            if (!req.user || !req.user.role || !req.user.role.permissions) {
                return RequestResponseMappings.sendErrorMessage(res, {}, "Unauthorized access", 401);
            }

            const userRole = req.user.role.name;
            const userPermissions = req.user.role.permissions.map((permission: any) => permission.name); // Extract the permission names

            if (userRole === 'Super Admin') {
                return next();
            }

            // Check if the user has at least one of the required permissions
            const hasPermission = permissions.some(permission => userPermissions.includes(permission));

            if (!hasPermission) {
                return RequestResponseMappings.sendErrorMessage(res, {}, "Forbidden: Insufficient permissions", 403);
            }

            // If the user is a Site Admin, check if they are assigned to the project
            if (userRole === 'Site Admin') {
                const projectId = req.params.projectId; // Assuming project ID is in route params
                
                const isAssignedToProject = await checkIfSiteAdminAssignedToProject(req.user.id, projectId);

                if (!isAssignedToProject) {
                    return RequestResponseMappings.sendErrorMessage(res, {}, "Forbidden: You are not assigned to this project", 403);
                }
            }

            next(); // User has the required permission and is authorized
        } catch (error: any) {
            return RequestResponseMappings.sendErrorMessage(res, {}, error.message, 500);
        }
    };
};

Explanation:

1. Super Admin Check: We first check if the user has the Super Admin role. If they do, they are allowed to proceed with any operation, skipping other checks.
2. Permission Check: Check if the user has the required permissions for the route.
3. Site Admin Check: If the user is a Site Admin, the code checks if they are assigned to the specific project they are trying to edit. This is done using the checkIfSiteAdminAssignedToProject function (you’ll need to implement this function to query the database and verify the user’s assignment).

EDIT

Define roles and permissions

interface Permission {
     name: string; // e.g., 'EDIT_PROJECT', 'VIEW_TEAM'
     entityType: string; // e.g., 'Project', 'Team'
     entityId: number; // specific project or team ID
   }




interface Role {
     name: string; // 'Super Admin', 'Site Admin'
     permissions: Permission[];
   }



   interface User {
     id: number;
     role: Role;
   }

Service to check for user role and permission

const hasPermissionForEntity = async (
     user: User, 
     requiredPermission: string, 
     entityType: string, 
     entityId: number
   ): Promise<boolean> => {
     if (user.role.name === 'Super Admin') {
       return true;
     } //this check can be removed and Super Admin users can be treated same as all users, and follow below logic
     // Check if the user has the required permission for the specific entity
     return user.role.permissions.some(permission =>
       permission.name === requiredPermission &&
       permission.entityType === entityType &&
       permission.entityId === entityId
     );
   };

Middleware to check the entity type and ID provided in the request:

const authorizeForEntity = (requiredPermission: string, entityType: string) => {
     return async (req: Request, res: Response, next: NextFunction) => {
       const { user } = req;
       const entityId = req.params.entityId; // Assuming entity ID is passed in the route params
   
       if (!user || !entityId) {
         return res.status(401).send('Unauthorized');
       }

       const hasPermission = await hasPermissionForEntity(user, requiredPermission, entityType, Number(entityId));

       if (!hasPermission) {
         return res.status(403).send('Forbidden: Insufficient permissions');
       }

       next(); // Proceed if permission check passes
     };
   };

Hope this helps