search

dcycle / starterkit-node

0 stars 1 forks source link

Restricted by permission #39

Closed suresh-kumara-gist closed 3 months ago

suresh-kumara-gist commented 3 months ago

I have created the restricted by permissions folders, restricted by permissions module and loading it in versioned.yml.

As a anonymous user I am accessing restricted folder files

http://0.0.0.0:8428/private/restricted-by-permission/permission-xyz2/access/index.html http://0.0.0.0:8428/private/restricted-by-permission/permission-xyz/access/index.html

http://0.0.0.0:8428/private/restricted-by-permission/permission-xyz/access/styles.css

http://0.0.0.0:8428/private/restricted-by-permission/permission-xyz2/access/styles.css

I am getting response from no-access/index.html .

After that I have added permission to admin to view content xyz await app.c('authentication').addNonUniqueFieldToUser('admin', 'permissions', {'view-content-xyz': 1});

then I have logged in as a admin and try to access above urls still I am getting content from no-access/index.html .

I have gone through logs ./scripts/log.sh . 


loggedIn
node-1  | {
node-1  |   _id: new ObjectId('66be24308d2a64c0ac46eca8'),
node-1  |   username: 'admin',
node-1  |   __v: 0,
node-1  |   hello: 'world',
node-1  |   hello3: 'world',
node-1  |   permissions: { 'view-content-xyz': 1 }
node-1  | }
node-1  | {
node-1  |   _id: new ObjectId('66be24308d2a64c0ac46eca8'),
node-1  |   username: 'admin',
node-1  |   __v: 0,
node-1  |   hello: 'world',
node-1  |   hello3: 'world',
node-1  |   permissions: { 'view-content-xyz': 1 }
node-1  | }
node-1  | hello
node-1  | undefined
node-1  | undefined
node-1  | undefined
node-1  | permissions
node-1  | undefined

I am getting req.user.permissions as undefined. I have to solve this issue now.

suresh-kumara-gist commented 3 months ago

right now admin current permission 'view-content-permission-xyz' is '0'. I want to update it to 1 to verify that admin can access xyz folder. Getting error at below code. 

    const u = await app.c('authentication').user('admin');
    // Updating permission for Admin user to access xyz.
    app.c('authentication').userFieldValue(u, 'view-content-permission-xyz', '1');

ReferenceError: app is not defined at Context. (/app/test/testRestrictedByPermission.js:162:15) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) ✔ User with access xyz permission should see the content of restricted by permissions xyz folder files only (644ms)

I think these tests referring to main database, If run test script that is going to update the permission of a admin in main database. we need to look into this as well.