herbsjs / buchu

Use Cases - Uniform, auditable and secure use case library
Other
24 stars 22 forks source link

Improve usecase to validate if it contains an authorization method #86

Open maikvortx opened 2 years ago

maikvortx commented 2 years ago

Is your feature request related to a problem? Please describe.

The authorization method is returning Not Authorized when an usecase doesn't have implementation for authorize method. Thus, when we call uc.authorize(user) , buchu returns 'Not Authorized' because usecase doesn't have implementation for it.

Describe the solution you'd like

Often, usecases have authorization but sometimes we have usecase that don't implement the authorization method. As we use defaultResolver in our applications to standardize routes, we can implement validation on buchu to validate if usecase has an authorization method.

image

Describe alternatives you've considered

While an alternative, I'm checking the ucRunner._authorize property to validate if the usecase has an authorized implementation.

image

maikvortx commented 2 years ago

@dalssoft what you think about it?

dalssoft commented 2 years ago

mixed feelings here. (1) it would be ok to ignore authorize: async (user) => and make it optional. But keeping uc.authorize(user), which now would return the same result as authorize: async (user) => Ok() when there is no authorize: async (user) => informed.

(2) however, I'm afraid that making authorize: async (user) => optional would make security a second class citizen inside Herbs.