Hi,
I am trying to do the following:
- Define express-authorize as global
- During login set the permissions of the logged user
- When trying to access any REST API use isPermitted to test permissions
express-authorize instance is defined in a separate file like this
var authorizer = require('express-authorize');
module.exports = authorizer;
During login I try to set the default options like this:
authorizer.options.withSubject = {
username: username,
permissions: authorizerPermissions
};
username is the name of the user which logged to the machine
authorizerPermissions is a result of a function which returns array of list items (example: ['configuration:view', 'configuration:delete']
The REST API call looks like this
router.get('/about', authorizer.isPermitted('configuration:view'), function(req, res) {...
Results:
permission check always fail whether a user is permitted or not to access the resource.
if I set the authorizer in the same file which implements the REST API it works ok
so if I place this code
authorizer.options.withSubject = {
username: username,
permissions: authorizerPermissions
};
in the same file of this code
router.get('/about', authorizer.isPermitted('configuration:view'), function(req, res) {...
it will work
If I comment the isPermitted check in the REST API and print the content of authorizer it looks ok, meaning I can see my settings which was set during login.
Any ideas what I am doing wrong?