search

Meteor-Community-Packages / meteor-roles

Authorization package for Meteor, compatible with built-in accounts packages
http://meteor-community-packages.github.io/meteor-roles/
MIT License
921 stars 168 forks source link

Remove user from Group #136

Closed ErnestClose closed 9 years ago

ErnestClose commented 9 years ago

Hi, is there a way to remove a user from a group? When using Roles.removeUsersFromRoles(this._id, ['role'], 'group') the users role is removed for that group so how can I remove him from the group as well? My user now belongs to a group, but has no role or permissions in that group.

alanning commented 9 years ago

The current version of roles is only focused on authorization within a group, not membership.

Some apps restrict users to only be a member of a group if they have a certain role or permission in the group. Others allow users to be a member of a group even if they don't have any permissions defined yet for that group.

So not sure if Roles should also be used to imply membership.

For example, in my own app, users can be in different "networks". We use the network id as the Roles group but we also have a separate field to hold which 'networks' the user is a member of. The benefit to our users is that admins can add a user to a network and then later decide what access they should have. The user will still show up in a list of network users even with no permissions defined.

alanning commented 9 years ago

If you wanted to you could monkey patch the Roles removeUsersFromRoles function and make sure that the field is deleted from the user object when all permissions are gone. But I think you will run into performance issues because the roles groups can not be indexed due to the current schema.

Closing this but feel free to continue the thread with other questions if you like.