Express and Angular4: Handling different types of users and roles

I am starting a new project, and I'm overwhelmed by the complexity of this user base. I am expected to create a CRM for different types of users and roles.

I have the following users I need to consider for my project:

A. Brokerage:
1. Owner
2. Employee(s)

B. Dealership:
1. Owner
2. Employee(s)

C. Customer

Basically what's confusing me is 3 user types, and two of them have "levels", and I am not sure how to handle that.

For now, I have their differences recorded in two collections: 1. user.role is either "Owner", "Employee", or "Customer" (if user !== 'Customer) 2. user.organization is a ref of organization.id. this organization has a type either Brokerage or Dealership

What are the best practices for modeling this? Even though both Brokerages and Dealerships both have owners and employees, their organization type distinguishes their role, and their role defines their "access level" (i guess..)

All users are sharing the same User schema (good practice?) Despite the fact that there are a few differences between them, they have a lot in common (login, logout, register, etc...).

Some differences:

1. Brokers and Dealers are part of an Organization (of type Brokerage or Dealership), Customers are not part of an Organization.

2. Only Dealers have a deliverySchedule. How can I make this optional with Mongoose?

3. Owners can add Employees to their organization. (Basically be able to create a new user and append the current user's organization _id to the new user's organization _id)

4. Customers can upload Docs, Dealers can view Docs, Brokers cannot see Docs rather only the status of the Docs. In other words, a customer uploads a written form, the dealer can view the form. When user uploads form, status: "Uploaded". When a dealer views the docs, status: "Viewed". (This can be done from the db with a field property, so I'm not too worried, just trying to be verbose)

5. Every user can access all the routes except each page will have an NgSwitch for Broker, Dealership, and Customer -- and ngIf on "owner" or "employee" in the views.

Organization Model:

var OrganizationSchema = new mongoose.Schema({
    status: String, // [active, inactive]
    type: {type: String, unique: true, required: true, required: [true, "can't be blank"]}
}, {timestamps: true});

OrganizationSchema.plugin(uniqueValidator, {message: 'is already taken.'});

mongoose.model('Organization', OrganizationSchema);

User Model:

var UserSchema = new mongoose.Schema({
  status: String, // [registered, active, inactive, banned, ...]
  firstName: String,
  lastName: String,
  organization: [{ type: mongoose.Schema.Types.ObjectId, ref: 'Organization' }],
  role: String, // [customer, manager, admin]
  hash: String,
  salt: String,
  deliverySchedule: String // MAKE OPTIONAL

}, {timestamps: true});

UserSchema.plugin(uniqueValidator, {message: 'is already taken.'});


mongoose.model('User', UserSchema);

I am looking for advice, guidance, and even some tips to improve the architecture of my API.

via Moshe