Detailed explanation of user rights management of nodejs acl

This article mainly introduces the detailed explanation of user rights management of nodejs acl. Now I share it with you and give you a reference.

Instructions

Q: What is this tool used for?

A: Users have different permissions, such as administrator, vip, ordinary Users, each user accesses the API, and the page is different

nodejs has two well-known permission management modules, one is acl and the other is rbac. After a comprehensive comparison, I finally chose acl## when working on the project.

#Function list:

##addUserRoles //Add a role to a user
removeUserRoles //Remove A certain user role
userRoles //Get all the roles of a certain user
roleUsers //Get all the users with this role
hasRole // Whether a user is a certain role
addRoleParents //Add a parent role to a certain role
removeRoleParents //Remove a certain parent role or all parent roles
removeRole //Remove a certain role
removeResource //Remove A certain resource
allow //Add certain permissions to certain resources to certain roles
removeAllow //Remove certain permissions for certain roles Certain permissions for certain resources
allowedPermissions //Query all resources and permissions of a person
isAllowed //Query whether a person is There is a certain permission for a certain resource
areAnyRolesAllowed //Query whether a certain role has a certain permission for a certain resource
whatResources //Query whether a certain role has a certain permission Which resources
middleware //middleware for express
backend //Specification method (mongo/redis...)

roles Role

1. addRoleParents

2. allow

3. removeAllow

4. ##resources Resources

whatResources

1. removeResource

2. permissions Permissions

allowedPermissions

1. isAllowed

2. addUserRoles

3. ##removeUserRoles

4. userRoles

5. roleUsers

6. hasRole

7. areAnyRolesAllowed

8. How to use

1. Assign corresponding permissions after the user logs in

2. Use acl for verification where control is required

3. Configuration file

const Acl = require('acl');
const aclConfig = require('../conf/acl_conf');

module.exports = function (app, express) {
  const acl = new Acl(new Acl.memoryBackend()); // eslint-disable-line

  acl.allow(aclConfig);

  return acl;
};

// acl_conf

module.exports = [
  {
    roles: 'normal', // 一般用户
    allows: [
      { resources: ['/admin/reserve'], permissions: ['get'] },
    ]
  },
  {
    roles: 'member', // 会员
    allows: [
      { resources: ['/admin/reserve', '/admin/sign'], permissions: ['get'] },
      { resources: ['/admin/reserve/add-visitor', '/admin/reserve/add-visitor-excel', '/admin/reserve/audit', '/admin/sign/ban'], permissions: ['post'] },
    ]
  },
  {
    roles: 'admin',  // 管理
    allows: [
      { resources: ['/admin/reserve', '/admin/sign', '/admin/set'], permissions: ['get'] },
      { resources: ['/admin/set/add-user', '/admin/set/modify-user'], permissions: ['post'] },
    ]
  },
  {
    roles: 'root', // 最高权限
    allows: [
      { resources: ['/admin/reserve', '/admin/sign', '/admin/set'], permissions: ['get'] },
    ]
  }
];

Copy after login

proofcheck

function auth() {
    return async function (req, res, next) {
      let resource = req.baseUrl;
      if (req.route) { // 正常在control中使用有route属性 但是使用app.use则不会有
        resource = resource + req.route.path;
      }
      console.log('resource', resource);

      // 容错 如果访问的是 /admin/sign/ 后面为 /符号认定也为过
      if (resource[resource.length - 1] === '/') {
        resource = resource.slice(0, -1);
      }

      let role = await acl.hasRole(req.session.userName, 'root');

      if (role) {
        return next();
      }

      let result = await acl.isAllowed(req.session.userName, resource, req.method.toLowerCase());
      // if (!result) {
      //   let err = {
      //     errorCode: 401,
      //     message: '用户未授权访问',
      //   };
      //   return res.status(401).send(err.message);
      // }
      next();
    };
  }

Login permission allocation

let roleName = 'normal';

  switch (result.result.privilege) {
    case 0:
      roleName = 'admin';
      break;
    case 1:
      roleName = 'normal';
      break;
    case 2:
      roleName = 'member';
      break;
  }

  if (result.result.name === 'Nathan') {
    roleName = 'root';
  }

  req.session['role'] = roleName;
  // req.session['role'] = 'root';  // test
  acl.addUserRoles(result.result.name, roleName);
  // acl.addUserRoles(result.result.name, 'root'); // test

Rendering logic control in pug page

1. When permission control is required Where, use a function to determine whether the user has permission to access

2. I am using the ending plan 2. Because it is more convenient, but the problem is that express pug does not support asynchronous writing. What acl provides us is all asynchronous. Due to time reasons, I did not delve into the judgment inside, but adopted a judgment method with higher coupling but more convenient.

app.locals.hasRole = function (userRole, path, method = 'get') {

  if (userRole === 'root') {
    return true;
  }

  const current = aclConf.find((n) => {
    return n['roles'] === userRole;
  });

  let isFind = false;
  for (let i of current.allows) {
    const currentPath = i.resources; // 目前数组第一个为单纯的get路由
    isFind = currentPath.includes(path);

    if (isFind) {
      // 如果找到包含该路径 并且method也对应得上 那么则通过
      if (i.permissions.includes(method)) {
        break;
      }

      // 如果找到该路径 但是method对应不上 则继续找.
      continue;
    }
  }

  return isFind;
};

Copy after login

if hasRole(user.role, '/admin/reserve/audit', 'post')
          .col.l3.right-align
            a.waves-effect.waves-light.btn.margin-right.blue.font12.js-reviewe-ok 同意
            a.waves-effect.waves-light.btn.pink.accent-3.font12.js-reviewe-no 拒绝

End

1. Prepare the data every time you render

2. const hasBtn1Role = hasRole(user.role, '/xxx','get');
   res.render('a.pug',{hasBtn1Role})

   Copy after login

   The above is what I compiled for everyone. I hope it will be helpful to everyone in the future.

   Related articles:

   How to use better-scroll plug-in in Angular_AngularJS
   

   Angularjs implementation between controllers Summary of communication method examples
   

   JavaScript code to implement the upload preview function of txt files
   

The above is the detailed content of Detailed explanation of user rights management of nodejs acl. For more information, please follow other related articles on the PHP Chinese website!