akveo / akveo/nebular

Unexpected behavior with NbRoleProvider

未关闭
#2,218 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
TypeScript
星标
8.1k
派生
1.5k
PR 合并指标
30 天内没有已合并 PR

描述

### Issue type

**I'm submitting a ...** (check one with "x")

* [x] bug report
* [ ] feature request

### Issue description

**Current behavior:**
The admin console button has an `*nbIsGranted="['view', 'Admin']"` on it so only users with the Admin role can see the button as part of my client side security. However when a user logs out that had the 'Admin' role and a new user logs in with a different role, the Admin console button remains visible. When you log in with a 'normal' user and swap to a user with the 'Admin' role, the button is not visible until the 'Admin' relogs at least once.
![button-display](https://user-images.githubusercontent.com/43498109/74347381-4deab900-4db1-11ea-8d6b-d92a07c4d0bb.JPG)

**Expected behavior:**
The admin console button should not be visible to users that do not have the 'Admin' role. Code from my custom role provider below.

**Steps to reproduce:**
1. Assign roles to your users.
2. Log out with user with 'elevated' priviliges.
3. Log in with 'normal' user.
The user roles are not stored in the token, but in a Firestore Document, hence there is an additional method to get the role for the user.

**Related code:**
`role.provider.ts`
```
@Injectable()
export class RoleProvider implements NbRoleProvider {

user = {}
private userDoc: AngularFirestoreDocument;
userProfile: Observable;
data: any;
role: string;

constructor(private authService: NbAuthService, public afs: AngularFirestore, public afAuth: AngularFireAuth) {
}

getRole(): Observable {
return this.authService.onTokenChange()
.pipe(
map((token: NbAuthJWTToken) => {
return token.isValid() ? this.checkRole(token) : 'Guest';
}),
);
}

checkRole(token: NbAuthJWTToken): string {
this.user = token.getPayload();
console.log('User id from token: ' + this.user['user_id']);
this.userDoc = this.afs.doc(`Users/${this.user['user_id']}`);
this.data = this.userDoc.get().subscribe(doc => {
if (doc.exists)
{
//console.log('Document data:', doc.data());
this.role = doc.data().role;
// console.log('Checkpoint good: ' + this.role);
} else {
this.role = "Guest";
// console.log('Worst case' + this.role);
}
});
return this.role;
}

}
```

`app.module.ts`

```
@NgModule({
declarations: [
//...
],
imports: [
//...
NbSecurityModule.forRoot({
accessControl: {
Guest: {
view: 'Guest',
},
Authenticated: {
parent: 'Guest',
view: 'Authenticated',
},
Admin: {
parent: 'Authenticated',
view: '*',
},
},
}),

],
bootstrap: [AppComponent],
providers: [
AuthGuard, { provide: NbRoleProvider, useClass: RoleProvider },
]
})
export class AppModule {
}

```

### Other information:

**npm, node, OS, Browser**
```
Node, npm: `node --version` v12.13.1 and `npm --version` 6.12.1
OS: Windows (10).
Browser: Chrome
```

**Angular, Nebular**
```
"name": "ngx-admin",
"version": "4.0.1",
```

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。