identity/initializers/permission.js

Identity client

exports.permission = function(api, next){

  var errors = api.config.errors;
  
  if(!errors.invalid_user){
    errors.invalid_user = 'invalid user'; //default value
  }

  api.actions.addPreProcessor(function(connection, actionTemplate, next){

    //check actions `requireAuth` config
    if(actionTemplate.requireAuth !== false){
      //if we dont have a user
      if(!connection.user){
        connection.error = errors.invalid_user;
        connection.rawConnection.responseHttpCode = 401;  
        return next(connection, false);
      }
    }
    
    //check actions `requireRole` config
    if(actionTemplate.requireRole){
      //cast to array
      if(!(actionTemplate.requireRole instanceof Array)) actionTemplate.requireRole = [actionTemplate.requireRole];
      var allowed = false;
      
      
      if(connection.user){
        //loop given roles
        for(var i = 0; i < actionTemplate.requireRole.length; i++){
          var role = actionTemplate.requireRole[i];
          //if user is has any role, it's allowed
          if(connection.user.hasRole(role)){
            allowed = true;
            break;
          }
        }
      }
      
      
      if(!allowed){
        connection.error = errors.invalid_user;
        connection.rawConnection.responseHttpCode = 401; 
        return next(connection, false);
      }
    }
        
    
    return next(connection, true);
  }, 60);
  
  next();
  
};