the dynamic user role for the loopback application.
npm install loopback-component-role-userThis loopback component add a new dynamic user role which mapping the operators of model to the role.
The role name should be '[modelName]' + '.' + '[operator]'. The role should be mapped into the ACL too.
And the role can be nested like this:
``coffee
Role1:
User.add
Role2:
Role1
Role3:
Role2
`
The Role3 should has the User.add role too.
The role could have multi containers of permission(aother role) or permissions.
The Permission is the model with operation. You can use the * to match the any model or any operation.'.add', 'User.'
eg, .
Add the .owned dynamical roles to edit, view, find, and delete roles as postfix.
For only edit/delete/view/find owned items.
Note:
* The same role could be exists in multi-roles.
* Disable batch update roles.
* The nested max level of role to limit. see config: maxLevel
1. Install in you loopback project:
npm install --save loopback-component-role-user
2. Create a component-config.json file in your server folder (if you don't already have one)
3. Configure options inside component-config.json:
`json`
{
"loopback-component-role-user": {
"enabled": true,
"cached": 0,
"role": "$user",
"userModel": "User",
"roleIdFieldName": "name",
"rolesFieldName": "roles",
"permsFieldName": "_perms",
"roleRefsFieldName": "_roleRefs",
"models": [],
"operations":[]
}
}
enabled
- [Boolean]: whether enable this component. defaults: truecached
- : [Integer]: whether cache the perms. defaults: 10
* 'none': no cache. you can write the custom _getPerms class method on the Role model to your cache.1
* 'updated': the cached perms updated when the role updated(default)2
* 'manual': if the _perms is not empty use the cached _perms else calc perms and update the _perms._perms
* NOTE: you should update the field by yourself. just empty it for updated.deleteUsedRole
- [Boolean]: whether allow to cascade delete used roles. defaults: falsecached
* only for updated : 1.maxLevel
- [Integer]: the max nested role level to limit. defaults: 10role
- [String] : the role name. defaults: $userroleModel
- [string]: The role model to inject. defaults: RolerolesFieldName
* The and permsFieldName fields will be added to the Model.hasPerm
* The method will be added to the Model.addRoles
* The and removeRoles methods will be added if the rolesFieldName is 'roles'.Role.addRoles
* The and Role.removeRoles permissions are added too.userModel
- [string]: The user model to inject. defaults: UserrolesFieldName
* The and permsFieldName fields will be added to the User Model.hasPerm
* The method will be added to the User Model.addRoles
* The and removeRoles methods will be added if the rolesFieldName is 'roles'.User.addRoles
* The and User.removeRoles permissions are added too.rolesFieldName
- [string]: The roles field to define. defaults: rolespermsFieldName
* The model(role) can have zero or more roles/permissions.
- [string]: The cached perms of this role. defaults: _permsownerFieldName
* Cache all the permissions to the roles(Readonly).
- [string]: The owner id field to define. defaults: creatorIdroleRefsFieldName
- [string]: The cached items which reference this role(Readonly). defaults: _roleRefsmodels
- [Boolean|Array of string]. defaults: truetrue
* enable the user role to the models. means all models in the app.models.operations
- [Object]: the mapping operations of model to the role name.key
* the is the operation(method), the value is the role name.
* Note: the operations name is the role name if no mapping operations.
defaults:*
`js`
{
create: 'add',
upsert: 'edit',
updateAttributes: 'edit',
exists: 'view',
findById: 'view',
find: 'find',
findOne: 'find',
count: 'find',
destroyById: 'delete',
deleteById: 'delete'
}
Just enable it on component-config.json.
set DEBUG=loopback:security:role:user env vaiable to show debug info.
Model::hasPerm(perm)
+ add the cached to determine whether cache the perms.
+ add the .owned dynamical roles to edit.owned, view.owned, find.owned, and delete.owned.
Only edit/delete/view/find owned items.
* remove the limits: The same permission CAN NOT be exists in multi-roles.
* [bug] the hasPerm should use the match function instead minimatch
* [bug] updatePermsByRefs can not work properly.
* [bug] mongodb error: key can not contain "." for _perms is object
* [bug] can not change itself to roleRefs after roles changed
+ add the maxLevel option to limit the max nested role level to avoid recusivedeleteUsedRole
* avoid exception when component not enabled.
+ add the option to allow or forbidden cascade delete
- remove the deprecated adminRole option. you can define the admin Role with . principal.hasRole
* rename the operators option to operations
* Customize the Role and User Model.
- remove Method.Roles
+ add the mxin.roles
* Define the and perms fields.hasPerm
* roles: the
* Add the , addRoles and removeRoles methods.hasPerm
+ add the , addRoles and removeRoles methods to Role and User Model.
* Performance optimization.
* cache permissions and references.
+ add the Role::hasRole`