11

Looking to use HapiJS as our API server. We need fine-grained user permissions, e.g. "User A can edit field B" "User C can view field D" for a given model / resource.

Before we start building something I've been looking to see if something like this has already been done that is compatible with Hapi.

Adamski
  • 3,585
  • 5
  • 42
  • 78

2 Answers2

4

I have just read an article where the ACL permissions are validated using the build-in scopes.

Here is the link to the mentioned article : https://blog.andyet.com/2015/06/16/harnessing-hapi-scopes/

And to resume quickly (using the example from the above link), you get a user object that looks like so : 

{
    "username": "han",
    "scope": ["door-trash-compactor"]
}

The scope can be generated by whatever is backing your ACL for this user. In this case you have the resource door with id trash-compactor that can be checked like so : 

server.route({
    method: 'GET',
    route: '/doors/{door_id}',
    config: {
        handler: function (request, reply) {
            reply(request.params.door_id ' door is closed');
        },
        auth: {
            scope: ['door-{params.door_id}']
        }
    }
});

The scope door-{params.door_id} will be translated to door-trash-compactor which will then be validated. Han's request to the trash compactor door will be valid and he will get the door is closed message.

The blog post is well written (much better then this summary) and describes this in better detail - would recommend the read.

blo0p3r
  • 6,790
  • 8
  • 49
  • 68
3

I've recently been working on an ACL project for hapijs. It should get you a good start. https://www.npmjs.org/package/hapi-authorization

Catfish
  • 18,876
  • 54
  • 209
  • 353
  • Just checked the plugin, and I have a question - could you implement it in a way that user can have multiple roles, which are not hierarchical, but on a same level, allowing access to different parts of the application (let's say, manages_users, and manages_products)? You could have a convetion that if user object has .role property, it's a single role; if it has .roles, then you expect an array and check against that – zappan Apr 02 '15 at 16:16
  • This functionality already exists and is the default. https://github.com/toymachiner62/hapi-authorization#plugin-config. If you have questions please submit github issues instead of posting on SO. – Catfish Apr 03 '15 at 17:02