How to achieve authorize the pages in MEAN stack web application?

Question

I am being writing the schema for the Application in mongodb. Usually in asp.net with Sql, We have assigned the pages/UIs to each roles which means role have the permission (view/edit) to access the page or not. When the role login to the Application he can only view/Edit in assigned pages to that role, un assigned pages will not be shown for that role.

In c# i have restrict the role with write the code in pre_init event. In MEAN Stack application, the same I am trying with the mongoDB.

var mongoose = require('mongoose'),
    Schema = mongoose.Schema;    


var rolesSchema = new Schema({
    role: { name: String },
    accessPage: { pagename: String, view: true, Edit: true }
});


var roles= mongoose.model('roles', rolesSchema );

I'm new to MEAN stack, How we can achieve the authorisation related stuffs in MEAN stack web application.

Answer 1

I think what you want is the level of authorization based on the role of the user, you may want to look at passport js . With passport js you will be able to handle authorization, and you can use node middlewares to handle authorization based on user's role.

Try to store user's role in req.user . Read passport documentation to know more about req.user

Sample middleware:

var isAdmin = function (req,res,next){
      if(req.user && req.user.role==='Admin')
          next();
     else{
         return;
    }
}

Use it in your node routes

router.post('/someRoute', isAdmin, function (req,res,next){
    //Handle your route here
});

Hope this helps you get some idea on how to handle authorization based on role.

Answer 2

The simplest way to do it would be with Passport:

• http://passportjs.org/

Passport is authentication middleware for Node.js. Extremely flexible and modular, Passport can be unobtrusively dropped in to any Express-based web application. A comprehensive set of strategies support authentication using a username and password, Facebook, Twitter, and more.

In the MEAN stack you're using Express, which supports any connect-style middleware like Passport.