mongoose-authz
This plugin allows you to define a custom authorization scheme on your mongoose models.
npm install --save mongoose-authz
Getting Started
'use strict';var mongoose = ;var authz = ; var userSchema = email: type: String required: true unique: true first_name: type: String required: true last_name: type: String required: true avatar: type: String last_login_date: type: Date status: type: String required: true default: 'active' ; /* * Make sure you add this before compiling your model */userSchemapermissions = defaults: read: 'email' 'first_name' 'last_name' 'avatar' admin: read: 'status' write: 'status' create: true owner: read: 'status' write: 'email' 'first_name' 'last_name' 'avatar' remove: true ; userSchema; moduleexports = mongoose;
In the example above we extended the userSchema by adding a permissions object. This will not persist to your documents.
The permissions object consists of properties that represent your authorization levels (or groups). For each group, there are 4 permissions you can configure.
create
- Booleanremove
- Booleanwrite
- [array of fields] NOTE: ifupsert: true
, the group will need to havecreate
permissions tooread
- [array of fields]
You can also specify a defaults
group, which represents permissions that are available to all groups.
If you need the document in order to determine the correct authorization level for an action, you can place a static getAuthLevel
function directly in your schema. For applicable actions, this function will be called with a specific document and a payload of data specified in the query. This is useful when the authorization level depends on matching properties of a user with properties of a specific document to determine if that user can modify that document.
getAuthLevel
approach does not work for update or remove queries since the document is not loaded into memory.
NOTE: The var mongoose = ; var carSchema = make: type: String required: true unique: true model: type: String required: true year: type: Number plate: type: String ; /* * Make sure you add this before compiling your model */carSchemapermissions = defaults: read: '_id' 'make' 'model' 'year' maker: write: 'make' 'model' 'year' remove: true dealer: read: 'plate' write: 'plate' ; carSchema { if payload && doc && payloadcompanyName === docmake return 'maker'; return 'dealer';}
In you application code, you could then do the following:
Car; // or myCar;
You can also have the permissions for a specific document injected into the document when returned from a find query using the permissions
option on the query. The permissions will be inserted into the object using the key permissions
unless you specify the desired key name as the permissions option.
const user = await User; console;// Outputs:// {// read: [...],// write: [...],// remove: [boolean]// } // ORconst user = await User; console;// Outputs:// {// read: [...],// write: [...],// remove: [boolean]// }
Example Uses
false
as the authLevel (e.g. myModel.find().setAuhtLevel(false).exec();
, which will disable authorization for that specific query).
NOTE: If no authLevel is able to be determined, permission to perform the action will be denied. If you would like to circumvent authorization, pass example update
You can also specify an array of authentication levels. This would merge the settings of each auth level.
users;
findOneAndUpdate
, the return document will be sanitized based on the group's permissions for read
NOTE: When using await users;
example find
await users;