search

luffynando / adonis-lucid-permission

Associate lucid models with roles and permissions
MIT License
5 stars 0 forks source link

permission_middleware not processing permissions through roles correctly. #6

Closed DrummerSi closed 6 months ago

DrummerSi commented 6 months ago

Your last update added functions to know if a user had permissions directly or through a role which was great..

But this doesn't work with the included middleware you have... It initially passes the 'canAnyPermission', but then runs the 'hasAnyPermission' and fails.

if ('canAnyPermission' in user && !(await user.canAnyPermission(...permissions))) {
    throw E_PERMISSION_UNAUTHORIZED_ACCESS.forPermissions(permissions);
}

if (!(await user.hasAnyPermission(...permissions))) {
    throw E_PERMISSION_UNAUTHORIZED_ACCESS.forPermissions(permissions);
}
return next();

should the canAnyPermission line return next() early, or should the hasAnyPermission function only be called if the 'canAnyPermission function fails?

Or is it simply not required anymore?