node.js - 授权中间件功能

Question

我正在尝试构建授权系统，node.js下面的代码一切正常。

授权.js

const expressJwt = require('express-jwt');
const userService = require('../routes/users/user.service');

module.exports = authorize;

function authorize(roles = []) {

    return expressJwt(
      { 
        <<SOME SECRET>>, 
        isRevoked: (req, payload, done) => _isRevoked(req, payload, done, roles) 
      })
      .unless(
      {
        path: [
        ]
      });
}

async function _isRevoked(req, payload, done, roles) {

    var user = await userService.getById(payload.sub);
    var userRoles = payload.role;

    // revoke token if user no longer exists
    if (!user) {
      console.log("Authorization: User not found")
        return done(null, true);
    }

    //check if user is authorized
    if (roles.length && !roles.every(elem => userRoles.indexOf(elem) > -1)) {
                // user's role is not authorized
                return done(null, true);
            }
    done()
};

角色控制器.js

const express = require('express')
const router = express.Router()
const authorize = require('helpers/authorize')

router.post('/create', authorize('Admin'), createRole)

module.exports = router

function createRole(req, res, next)
{
    //role creation code goes here
}

到目前为止一切正常，当create使用令牌请求路由时，authorize.js正在检查令牌是否有效以及在检查用户角色是否与路由角色匹配之后（例如admin这里）

现在，问题在这里

我正在尝试将authorize中间件移至RoleController.js. database并根据请求的路由获取模块的访问权限req.originalUrl

var isAuthorized = function (req, res, next)
{
    authorize(req.originalUrl) // just trying to check the authorization as a first level and moving forward to route only if authorized

    next();
}

router.post('/create', createRole) //Removed authorize here

更改为此后，它无法按预期工作。流程转到该authorize函数，但它没有调用该_isRevoked函数。

可能是因为async在，_isRevoked但我被困在这里继续。有任何想法吗？

标签： node.jsexpressmiddlewareexpress-jwt