ForbesLindesay / connect-roles

Provides dynamic roles based authorisation for node.js connect and express servers.
749 stars 62 forks source link

update permission on database #63

Closed RezaErfani67 closed 5 years ago

RezaErfani67 commented 5 years ago

i read permission from database... this is done just 1 time after loading program... if i update permission for any roles,the changes does not take effect until i restart my api server

let ConnectRoles = require('connect-roles');
const Permission = require('./permission');
let gate = new ConnectRoles({
  failureHandler: function (req, res, action) {
       var accept = req.headers.accept || '';

       // res.status(403);
       if (accept.indexOf('html')) {

           // res.render('errors/403', { action });
         return  res.json({isSuccess: false, type: "error",title: "شما دسترسی ندارید"});

       } else {

           return   res.json({isSuccess: false, type: "error",title: "شما دسترسی ندارید"});
       }
  }
});

//this function run 1 time

let permissions = async () => {

    return await Permission.find({}).populate('roles').exec();
}

permissions()
    .then(permissions => {
        console.log(permissions)
        permissions.forEach(permission => {
            let roles = permission.roles.map(item => item._id);
            gate.use(permission.title , (req) => {

                return req.user.hasRole(roles);

            });
        })
    });

module.exports = gate;

//authenticate jwt
app.use(gate.middleware());
ForbesLindesay commented 5 years ago

Yes, this is expected. you should be storing the list of roles in a variable that you can update over time, outside of the code calling gate.use. That way you would just call gate.use once for each permission, when your app starts, but it would always read the correct set of roles.