nodejs-crud
Wrapper of Sequelize ORM with CRUD operations & authorization level access.
The permission access works by simply adding a User owner relation to each model, then checking if operation allowed by the credentials role. If permission access is special 'owner', each CRUD operation request (but create) will be augmented with a corresponding WHERE condition.
Usage
const DbCrud = require('@dmidz/crud');
//_ create an instance
const crud = new DbCrud({
dir_models : Path.join( __dirname, 'models' ),//_ path to your Sequelize models
db_sequelize : {//_ Sequelize instantiation options passed as is
database : 'db_test',
// ...
},
auth_enabled: true,//_ if enabled, crud actions will check user permissions
model_owner:'User',//_ required if auth_enabled, defaults to 'User'
model_owner_fk: 'owner_id',//_ required if auth_enabled, user foreign key in restricted models
models: {//_ models options
User:{
sync:{//_ Sequelize sync option
force:true,//_ only for dev : should use migration scripts
},
roles : {//_ auth roles, each key is a role, which will be test against the credentials' role
user:{//_ value either an object with crud operations
read:'owner',//_ special string 'owner' means allowed only for owner user
},
admin:1,//_ a bool like is a shortcut for all actions ( admin can do everything here )
},
mock( model ){//_ helper to insert mock data at start
return model.bulkCreate([
{ login:'admin@domain.org', password: 'demo', roles: 'admin' },
{ login:'user1@domain.org', password: 'demo', roles: 'user' },
{ login:'user2@domain.org', password: 'demo', roles: 'user' }
] )
.then(function( users ){
//_ can do things with added mock entries
})
;
}
},
Task:{
sync:{ force:true },
// disabled:1,
roles:{
admin:1,//_ admin can performm every action on every entry
user: 'owner',//_ users can perform every action only on entries they own
}
},
},
onModels : function( models, Sequelize, plugin ){
//__ good place for associations ( after all models loaded but before sync )
models.Task.hasMany( models.Task, { as: 'children', foreignKey: 'parent' } );//_ Task could have sub tasks
}
});
//_ create 2 tasks with admin creds
crud.create('Task', [
{ title: 'Task 1'/*, owner_id:1*/ },//_ if no owner set, creds.id will be used
{ title: 'Task 2', owner_id:2 }//_ set owner user 2
], { credentials:{ id: 1, roles: 'admin' }, bulk:1 } )
.then(function( tasks ) {
console.log('# all tasks inserted', tasks );
//_ reading model with access role "owner" should return only owned ones.
crud.read('Task', { raw:true, credentials: { id: 2, roles: 'user' }, scopes:'collection' } )
.then(function( res ) {
//_ the result should be 1 row owned by user 2
console.log('### res :', res.length, res );
})
});
Please check out the test for more detail.