search

hubot-archive / hubot-auth

Assign roles to users and restrict command access in other scripts
149 stars 54 forks source link

Update README to include instructions for using auth in scripts #23

Closed jm-welch closed 7 years ago

jm-welch commented 8 years ago

Had to go looking for how to use this in another script, found it on StackOverflow. Something like the following in the README would help.

## Using hubot-auth in other scripts
Wrap restricted commands in a conditional like the following to ensure that only authorized users can execute them:

``` coffeescript
authorizedRoles = [
  'admin'
  'oss'
]

module.exports = (robot) ->
  robot.respond /do something/i, (msg) ->
    if (r for r in robot.auth.userRoles(msg.envelope.user) when r in authorizedRoles).length > 0
      # Restricted actions here
    else
      robot.reply "Only members of these groups #{authorizedRoles} can perform this command."


Will submit a PR when I have a chance, just dropping a note here until I can get that done.
chriskol commented 8 years ago

This might be a dumb question, but if I need to edit every single script file, and I'm not including node_modules in what I push because npm, how do I actually implement these changes when pushing to github or heroku? Do I need to use npm shrinkwrap? I'm a newbie.

jm-welch commented 8 years ago

I'm not sure, @chriskol. The only change proposed here is to the readme (sorry I still haven't gotten around to submitting that PR), not to individual scripts. Are you talking about adding the code in the example above to another script?

chriskol commented 8 years ago

@jm-welch exactly. Or even within these scripts. If I'm not uploading my node_modules file, how would I edit the scripts that npm is installing (especially if an update occurs and presumably overwrites that script)?

cecilia-sanare commented 7 years ago

Resolved via #54.

Let me know if you still have questions regarding using hubot-auth in scripts and I'll reopen the issue.

chriskol commented 7 years ago

@ceci-woodward I'm admittedly a bit of a newbie when it comes to this but I'm not sure where I'd actually do the wrapping. Would I need to edit each script individually? If that's the case, would that mean I would also need to make my own repo for each script I wish to restrict commands for and submit to npm so I can update the package.json file to pull from that particular repo with the wrapped script?

Edit: It would appear that's essentially the case as per the last paragraph of this page. It sucks I essentially lose the ability to easily update the scripts. Would be awesome if there was another way like a central config file or something. I'm sure it's possible but I don't have the chops :(