如何使用角色管理访问控制，以不允许基本用户更新未拥有的帐户

Question

在我的nodejsapi中，我使用这个npm-pkgaccesscontrol实现了角色，我还对令牌部分使用了JWT。我的问题是我无法限制基本角色用户更新非他/她自己的帐户。我想实现的是，管理员可以做他想做的任何事情，但作为基本的其他角色是有限的。在我的例子中，我希望具有基本角色的用户能够只更新其拥有的帐户，而不更新任何其他帐户，但现在该帐户不起作用。

在我的邮递员中，我正在用基本角色的令牌调用更新终结点，并尝试更新与令牌不关联的userId。我应该看到的是一条消息，上面写着您没有足够的权限来执行此操作，但是我可以更新。

我使用这个PKG AccessControl的角色

// Access controls roles
const AccessControl = require("accesscontrol");

let grantsObject = {
    admin: {
        user: {
            "create:any": ["*"],
            "read:any": ["*"],
            "update:any": ["*"],
            "delete:any": ["*"]
        }
    },
    basic: {
        user: {
            "create:own": ["*"],
            "read:own": ["*"],
            "update:own": ["*"],
            "delete:own": ["*"],
        }
    }
};

// Init
const accessCtrl = new AccessControl();

// Roles access
// Here adding the access rules and to what we give access to a specific role
// Basic, Moderator, Admin
// Admin => Read/Write full powers
// Moderator => Read access everywhere
// Basic => Read/write own information
exports.roles = (() => {
    accessCtrl.setGrants(grantsObject);

    return accessCtrl;
})();

我的路线

// PUT update user
router.put(
    "/:userId",
    Auth.allowIfLoggedin,
    Auth.grantAccess("updateOwn", "user"),
    UserCtrl.updateUser
);

使用的中间件：

/ Allowing access to right role permission
const grantAccess = (action, resource) => {
    return async (req, res, next) => {
        try {
            console.log(req.user.role);
            // Permission to perform the specified action of the provided resource
            const permission = Roles.roles.can(req.user.role)[action](resource);
            // No permission => 401
            if (!permission.granted) {
                throw new ErrorHandlers.ErrorHandler(
                    401,
                    "You don't have enough permission to perform this action"
                );
            }
            next();
        } catch (error) {
            next(error);
        }
    };
};

// Allow if user logged in
const allowIfLoggedin = async (req, res, next) => {
    try {
        console.log("LOCALS", JSON.stringify(res.locals));
        const user = res.locals.loggedInUser;
        if (!user)
            throw new ErrorHandlers.ErrorHandler(
                401,
                "You need to be logged in to perform this operation"
            );
        // User
        req.user = user;
        next();
    } catch (error) {
        next(error);
    }
};

module.exports = { grantAccess, allowIfLoggedin };

控制器

// UPDATE user
    async updateUser(req, res, next) {
        try {
            // Check empty req.body
            if (Object.keys(req.body).length === 0) {
                throw new ErrorHandlers.ErrorHandler(500, "Nothing to update");
            }
            // Body to update
            const update = req.body;
            // UserId to update
            const userId = req.params.userId;
            // Finding the user to update
            await User.findByIdAndUpdate(userId, update);
            // Updated user
            const user = await User.findById(userId);
            // Response
            res.status(200).json({
                user: user,
                message: "User has been updated"
            });
        } catch (error) {
            next(error);
        }
    },

Answer 1

因为您应该使用updateAny而不是updateOwn。这个技巧背后的想法是让管理员角色以完全权限访问此路由，然后添加条件以检查其他小情况，例如用户更新他/她自己的数据。

router.put(
    "/:userId",
    Auth.allowIfLoggedin,
    // Use updateAny instead of updateOwn
    Auth.grantAccess("updateAny", "user"),
    UserCtrl.updateUser
);

然后，检查grantAccess函数中的userId，如下所示。

// Allowing access to right role permission
const grantAccess = (action, resource) => {
    return async (req, res, next) => {
        try {
            const modifiedAction = action;
            // Check for userId and modify action from updateAny to updateOwn
            // when current user updates his/her own info
            if (req.user.userId === req.params.userId) {
                modifiedAction = action.replace('Any', 'Own');
            }

            // Permission to perform the specified action of the provided resource
            const permission = Roles.roles.can(req.user.role)[modifiedAction](resource);
            // No permission => 401
            if (!permission.granted) {
                throw new ErrorHandlers.ErrorHandler(
                    401,
                    "You don't have enough permission to perform this action"
                );
            }
            next();
        } catch (error) {
            next(error);
        }
    };
};

你可以在这里查看另一个关于授权的精彩视频。