Unexpected behavior with NbRoleProvider
- 主要语言
- TypeScript
- 星标
- 8.1k
- 派生
- 1.5k
- PR 合并指标
- 30 天内没有已合并 PR
描述
### Issue type
**I'm submitting a ...** (check one with "x")
* [x] bug report
* [ ] feature request
### Issue description
**Current behavior:**
The admin console button has an `*nbIsGranted="['view', 'Admin']"` on it so only users with the Admin role can see the button as part of my client side security. However when a user logs out that had the 'Admin' role and a new user logs in with a different role, the Admin console button remains visible. When you log in with a 'normal' user and swap to a user with the 'Admin' role, the button is not visible until the 'Admin' relogs at least once.

**Expected behavior:**
The admin console button should not be visible to users that do not have the 'Admin' role. Code from my custom role provider below.
**Steps to reproduce:**
1. Assign roles to your users.
2. Log out with user with 'elevated' priviliges.
3. Log in with 'normal' user.
The user roles are not stored in the token, but in a Firestore Document, hence there is an additional method to get the role for the user.
**Related code:**
`role.provider.ts`
```
@Injectable()
export class RoleProvider implements NbRoleProvider {
user = {}
private userDoc: AngularFirestoreDocument;
userProfile: Observable;
data: any;
role: string;
constructor(private authService: NbAuthService, public afs: AngularFirestore, public afAuth: AngularFireAuth) {
}
getRole(): Observable {
return this.authService.onTokenChange()
.pipe(
map((token: NbAuthJWTToken) => {
return token.isValid() ? this.checkRole(token) : 'Guest';
}),
);
}
checkRole(token: NbAuthJWTToken): string {
this.user = token.getPayload();
console.log('User id from token: ' + this.user['user_id']);
this.userDoc = this.afs.doc(`Users/${this.user['user_id']}`);
this.data = this.userDoc.get().subscribe(doc => {
if (doc.exists)
{
//console.log('Document data:', doc.data());
this.role = doc.data().role;
// console.log('Checkpoint good: ' + this.role);
} else {
this.role = "Guest";
// console.log('Worst case' + this.role);
}
});
return this.role;
}
}
```
`app.module.ts`
```
@NgModule({
declarations: [
//...
],
imports: [
//...
NbSecurityModule.forRoot({
accessControl: {
Guest: {
view: 'Guest',
},
Authenticated: {
parent: 'Guest',
view: 'Authenticated',
},
Admin: {
parent: 'Authenticated',
view: '*',
},
},
}),
],
bootstrap: [AppComponent],
providers: [
AuthGuard, { provide: NbRoleProvider, useClass: RoleProvider },
]
})
export class AppModule {
}
```
### Other information:
**npm, node, OS, Browser**
```
Node, npm: `node --version` v12.13.1 and `npm --version` 6.12.1
OS: Windows (10).
Browser: Chrome
```
**Angular, Nebular**
```
"name": "ngx-admin",
"version": "4.0.1",
```
贡献指南
评估
这个 Issue 还没有评估数据。