Add role based authorization

[nicolas-besnard]

I know this is not the purpose of this gem, but if you had to implement it to work with ng-token-auth, how would you do that ?

I'm working on a project based on this Gem, and I will need authorization for the iOs / Android app and later, the website.

[lynndylanhurley]

My current approach has been as follows:

1. Return a list of roles / permissions with the user object on validation. This will look something like this in the $auth.user object:

   {
     id: 1,
     // ...
     permissions: {
       // ...
       applications: {
         view: true,
         edit: false,
         destroy: false
       },
       // ...
   }

2. Define a permissions service on the client can check the user's permission object to determine their access to views / actions. This will look something like this when used in a template:

   <ul>
     <!-- ... -->
     <li ng-show="hasPermission('applications', 'view')">
       <a ui-sref='user.applications'>Applications</a>
     </li>
     <!-- ... -->
   </ul>

3. This is important - access to resources must be limited on the API as well as the client. We're using pundit for this.

This has been working for me in my apps, but I'm not sure if it can be generalized for every use case.

[pommerien]

Hi @lynndylanhurley, I just stumbled across the same requirement / issue. I understand your suggestion, however from an implementation standpoint I am struggling with (1). How does one modify the user object which is being returned by devise for both sign_in as well as validate_token? I am sure it has been asked before, but I could not find it. Basically in my case I have the "User" class and a "UserRole" class which roughly represents your "permissions" in the example above. So I would expect a return JSON object along these lines:
{
id: 1,
email: ...
//....
roles: [ phone_operator, printer_administrator ]
}

Any suggestions on how I tie in the relation?

[lynndylanhurley]

@pommerien - just override the token_validation_response in your User model. (You may need to update to the latest beta version for this to work. I'll push a new release ASAP).

The method to override is here.

[vs4vijay]

@lynndylanhurley overriding token_validation_response doesn't work, I had to override whole SessionController and TokenValidationsController for desired response.

cc: @pommerien