使用基于角色的权限的casl创建用户

Question

我正在尝试使用casl-mongoose进行基于角色的身份验证

role.js

    module.exports = function (user) {
      const ability = defineAbility((can) => {
        switch (user) {
          case "admin":
            can(["create", "read", "update", "delete"], "User");
            break;
          case "user":
            can("read", "User", { role: "user" });
            break;
               }
           });

     return ability;
     };

user.js

const defineAbilitiesForUser = require("../middleware/roles");

user = new User(_.pick(req.body, ["name", "email", "password", "role"]));
const ability = defineAbilitiesForUser(req.user.userRole);
// req.ability.throwUnlessCan("create", user);
ForbiddenError.from(ability).throwUnlessCan("create", user);

我想知道如何在casl中使用"create“，即使我正确使用了ForbiddenError。

ForbiddenError: Cannot execute "create" on "User"
    at Function.i.from (/home/madhu/Madhu/JavaScript/codedigital/casl_final/node_modules/@casl/ability/dist/umd/index.js:1:7009)
    at /home/madhu/Madhu/JavaScript/codedigital/casl_final/routes/users.js:52:18
    at processTicksAndRejections (internal/process/task_queues.js:97:5)

json对象

req.user : admin

{
    "name": "aaa",
    "email": "aaa@email.com",
    "password": "password",
    "role": "user"
    
}

Answer 1

我刚刚测试了您的代码，如果您传递"user"而不是req.user.userRole，您将无法创建用户，因为您的权限说明角色为" user“的用户只能读取角色为" user”的用户。

如果你传递了"admin"，那么一切都是正常的，并且不会抛出错误。

指向repl - https://repl.it/@stalniy/so-63132256的链接