How to get User permissions and pass them to login(user)

[benjibenoit]

Hey !

I'm having a little problem configuring permissions.
I have a user table and a permissions table (linked by relationship)
When someone logs in, I want the user to be made up of their data and their permissions. To do this, I've tried :

const user = await User.query()
    .preload('permissions')
    .where('email', googleUser.email!)
    .firstOrFail()

When I use this and I console.log the permissions just after it works. But if I do a login(user) and try to retrieve these permissions in a Policy for example, user.permission is empty.
How can I retrieve the permissions from the login and pass them to the app (here policy for example).
I also have a question: is it good practice to retrieve the permissions only at login and have the app manage them from there, or is it better to re-fetch the permissions at "every" request in case they have changed?

[aikrom]

Hey!

1. If you want to use permissions everywhere in the application, then it is better to load them somewhere in the middleware (after auth middleware) or make user.load('permissions') where they are needed.

2. Retrive permissions for every request (in middleware), or where it needed or retrive it somewhere and cache it.

[aikrom]

Middleware:

export default class LoadUserPermissions {
  public async handle({ auth }: HttpContextContract, next: () => Promise<void>) {
    if(auth.user) {
      await auth.user.load('permissions');
    }

   // Do some other checkin or something else

    await next()
  }
}

Then you can use authorized user permissions anywhere. For example, in controllers:

export default class UserPermissionsController {
  public async index({ auth }: HttpContextContract) {
    // User permissions already loaded
    return auth.user.permissions
  }
}

Or when define bouncer actions:

export const { actions } = Bouncer
  .define('view', (user: User, post: Post) => {
    // Check permission, all user permissions already loaded
    return user.permissions.some((permission) => permission.name === "view.post")
  })

Or in bouncer policy:

export default class PostPolicy extends BasePolicy {
  public view(user: User, post: Post) {
    // Check permission, all user permissions already loaded
    return user.permissions.some((permission) => permission.name === "view.post")
  }
}

[benjibenoit]

The only problem with that is : If I set the middleware to global, it will be executed before auth(). I therefore have to chain it in the routes. Is there any way of linking it to auth()?

[aikrom]

Why global? How do you make routes private?

[aikrom]

Make single route private:

Route
  .get('posts', 'PostController.index')
  .middleware(['auth', 'user.permissions'])

Make route group private:

Route.group(() => {
  Route.get('posts', 'PostController.index')
  // other routes
})
  .middleware(['auth', 'user.permissions'])

Make all routes private (start/kernel.ts):

Server.middleware.register([
  () => import('@ioc:Adonis/Core/BodyParser'),
  () => import('App/Middleware/Auth'),
  () => import('App/Middleware/LoadUserPermissions'),
])

[benjibenoit]

Yes, it works! Then, as the permissions are totally linked, I don't know if there's a way of adding them to the auth for example. Because I don't find it clean to call the middleware all the time when I put auth()