node express caching issue

Question

I have an app which sends a form schema with the data for page rendering.

The form schema comes from a require call to a configuration - this is in javascript object notation. Depending on the user's permission level, the function massageSchema then for example removes protected fields from the schema, prior to the schema being sent.

This all works. However, if I log out and log in as a different user, the schema relevant to the previous user is sent.

If I stop/start the node instance, the correct schema then gets sent.

So I've deduced that this appears to be a caching issue, but I have no clue as to how to address it.

The router code:

router.get('/:table/:id', authUser, resolveTableName, authMethodTable, function(req, res, next) {
    getTableModule(req.params.table)
    .then(mod => {
      // Massage the schema
      mod.formSchema = massageSchema(mod, req.session.user);
        ...
        db.one( sql, [ req.params.table, res.locals.table.idAttribute, req.params.id ])
         .then( row => {
          res.render("record", { 
            data: row,
            user: req.session.user,
            table: req.params.table,
            module: mod,
            referer: req.get('Referer')
          })
          ....

The massageSchema function:

module.exports = function(mod, user) {
  var rv = {};
  var orig = mod.formSchema ? mod.formSchema : mod.schema;
  // Remove unallowed fields
  for(var i in orig) {
    if(orig[i].display) { 
      if(orig[i].display == 'admin' && (user.role == 'admin' || user.role == 'master')) {
        rv[i] = orig[i];
      } else if(orig[i].display == 'editor' && 
        (user.role == 'editor' || user.role == 'admin' || user.role == 'master')) {
        rv[i] = orig[i];
      } 
    } else {
      rv[i] = orig[i];
    }
  }
  return rv;
};

Why is this happening? What to do?

Answer 1

I'm guessing mod is part of some module.exports ?. In JavaScript, objects are always passed by reference, including module.exports mod.formSchema = massageSchema(mod, req.session.user) is actually modifying the module's exported object.

try let schema = massageSchema(mod, req.session.user) instead