Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

mongoose-authorization

Package Overview
Dependencies
Maintainers
2
Versions
10
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

mongoose-authorization

Data level authorization for Mongoose

  • 2.0.0-alpha.1
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
10
decreased by-92.59%
Maintainers
2
Weekly downloads
 
Created
Source

mongoose-authorization

Build Status

This plugin allows you to define a custom authorization scheme on your mongoose models.

npm install --save mongoose-authorization

Getting Started

'use strict';
var mongoose = require('mongoose');
var authz = require('mongoose-authorization');

var userSchema = new mongoose.Schema({
  email: {
    type: String,
    required: true,
    unique: true
  },
  first_name: {
    type: String,
    required: true
  },
  last_name: {
    type: String,
    required: true
  },
  avatar: {
    type: String
  },
  last_login_date: {
    type: Date
  },
  status: {
    type: String,
    required: true,
    default: 'active'
  }
});

/*
 * Make sure you add this before compiling your model
 */
userSchema.permissions = {
  defaults: {
    read: ['email', 'first_name', 'last_name', 'avatar']
  },
  admin: {
    read: ['status'],
    write: ['status'],
    create: true
  },
  owner: {
    read: ['status'],
    write: ['email', 'first_name', 'last_name', 'avatar'],
    remove: true
  }
};

userSchema.plugin(authz);

module.exports = mongoose.model('users', userSchema);

In the example above we extended the userSchema by adding a permissions object. This will not persist to your documents.

The permissions object consists of properties that represent your authorization levels (or groups). For each group, there are 4 permissions you can configure.

  • create - Boolean
  • remove - Boolean
  • write - [array of fields] NOTE: if upsert: true, the group will need to have create permissions too
  • read - [array of fields]

You can also specify a defaults group, which represents permissions that are available to all groups.

If you need the document in order to determine the correct authorization level for an action, you can place a static getAuthLevel function directly in your schema. For applicable actions, this function will be called with a specific document and a payload of data specified in the query. This is useful when the authorization level depends on matching properties of a user with properties of a specific document to determine if that user can modify that document.

NOTE: The getAuthLevel approach does not work for update or remove queries since the document is not loaded into memory.
var mongoose = require('mongoose');

var carSchema = new mongoose.Schema({
    make: {
        type: String,
        required: true,
        unique: true
      },
    model: {
        type: String,
        required: true
      },
    year: {
        type: Number
      },
    plate: {
        type: String
      }
  });

/*
 * Make sure you add this before compiling your model
 */
carSchema.permissions = {
    defaults: {
        read: ['_id', 'make', 'model', 'year']
      },
    maker: {
        write: ['make', 'model', 'year'],
        remove: true
      },
    dealer: {
        read: ['plate'],
        write: ['plate']
      }
  };

carSchema.getAuthLevel = function (payload, doc) {
    if (payload && doc && payload.companyName === doc.make) {
        return 'maker';
    }

    return 'dealer';
}

In you application code, you could then do the following:

Car.find({}, null, { authPayload: { companyName: 'Toyota' } }).exec(...);

// or

myCar.save({ authPayload: { companyName: 'Honda' } });

You can also have the permissions for a specific document injected into the document when returned from a find query using the permissions option on the query. The permissions will be inserted into the object using the key permissions unless you specify the desired key name as the permissions option.

const user = await User.find().setOptions({ authLevel: 'admin': permissions: true }).exec();

console.log(user.permissions);
// Outputs:
// {
//   read: [...],
//   write: [...],
//   remove: [boolean]
// }

// OR
const user = await User.find().setOptions({ authLevel: 'admin': permissions: 'foo' }).exec();

console.log(user.foo);
// Outputs:
// {
//   read: [...],
//   write: [...],
//   remove: [boolean]
// }
Example Uses
NOTE: If no authLevel is able to be determined, permission to perform the action will be denied. If you would like to circumvent authorization, pass false as the authLevel (e.g. myModel.find().setAuhtLevel(false).exec();, which will disable authorization for that specific query).

example update

You can also specify an array of authentication levels. This would merge the settings of each auth level.

users.update({user_id: userUpdate.user_id}, userUpdate, {
  authLevel: 'admin'
}, function(err, doc) {
  if (err) {
    //handle error
  } else {
    //success
  }
});
NOTE: When using findOneAndUpdate, the return document will be sanitized based on the group's permissions for read
await users.findOneAndUpdate(
  { user_id: userUpdate.user_id },
  userUpdate,
  { authLevel: 'admin'}
);

example find

await users.find(
  { user_id: userUpdate.user_id },
  null,
  { authLevel: 'admin' }
);

Keywords

FAQs

Package last updated on 24 May 2018

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc