Repository navigation
Not MVC resources ? #249
Description
Hi,
Is it possible to use this module with resources wich are not MVC ?
I want to protect instance objects rather than routes.
I want to do something like this into my controller (i'm using routing-controllers):
@Get("/myaction/candidat_id/:candidat_id")
test((@Param("candidat_id") candidat_id: number, @Req() request: Request, @Res() response: Response)
{
...
if (acl.isAllowed(myUserId, myArticleId, 'show') {
// display article
}
}
Activity
[-]Non MVC resources ?[/-][+]Not MVC resources ?[/+]john-osullivan commentedon Sep 22, 2017
Your question is kind of unclear, as Model View Controller doesn't really apply in this ACL context. I'm not using the middleware, so no ideas on how it would work there, but you can just make one resource for every article.
It looks like the pattern for max granularity is to:
article-<id>)user-<id>)article-<id>/show,article-<id>/edit, etc.), such that rolearticle-id/<show>has permissionshowonarticle-<id>whilearticle-id/<edit>could have permissionsshowandreadonarticle-<id>. That way you can get hierarchical permission levels with fewer operations when granting permission to a user.user-<id>becomes a child ofarticle-<id>/show)Not sure how it scales, but that provides the most granularity across the application. Note that I'm not a contributor to this library, just a developer in the process of implementing the pattern as described. Would love to hear from @manast about any issues he'd foresee as this pattern scales!