Question

我的网络应用的客户希望完全将常规用户和管理员分开，因此我尝试为passport.js实施两个本地策略：

passport.use('local', new LocalStrategy({
    usernameField: 'email'
}, function(email, password, done) {
    User.findOne({ email: email }, function(err, user) {
        if (err) return done(err);
        if (!user) return done(null, false, { message: 'Wrong email or password.' });
        if (!user.validPassword(password)) return done(null, false, { message: 'Wrong email or password.' });
        done(null, user);
    });
}));

passport.use('admin', new LocalStrategy({
    usernameField: 'email'
}, function(email, password, done) {
    Admin.findOne({ email: email }, function(err, admin) {
        if (err) return done(err);
        if (!admin) return done(null, false, { message: 'Wrong email or password.' });
        if (!admin.validPassword(password)) return done(null, false, { message: 'Wrong email or password.' });
        done(null, admin);
    });
}));

passport.serializeUser(function(user, done) {
    done(null, user.id);
});

passport.deserializeUser(function(id, done) {

    Admin.findById(id, function(err, admin) {
        if (err) return done(err);
        if (admin) return done(null, admin);
        User.findById(id, function(err, user) {
            done(err, user);
        });
    });
});

然后在我的API管理路由器中：

router.post('/', function(req, res, next) {
    if (typeof req.body.email === 'undefined') return res.json({ success: false, message: 'Email not supplied.' });
    if (!validator.isEmail(req.body.email)) return res.json({ success: false, message: 'Wrong email format.' });
    if (typeof req.body.password === 'undefined') return res.json({ success: false, message: 'Password not supplied.' });
    if (req.body.password.length === 0) return res.json({ success: false, message: 'Password not supplied.' });

    passport.authenticate('admin', function(err, admin, info) {
        if (!admin) return res.json({ success: false, message: info.message });
        req.logIn(admin, function(err) {
            if (err) return res.json({ success: false, message: 'Server error.', reason: err });
            console.log('user:');
            console.log(req.user); // both users and admins go here
            console.log('admin:');
            console.log(req.admin); // undefined
            res.json({ success: true });
        });
    })(req, res, next);

});

事实上，我在这里听到了答案：https://stackoverflow.com/a/21898892/1830420，Matthew Payne获得了两个会话变量：req.user和req.sponsor。就我而言，即使管理员进行身份验证，也会将其写入req.user。现在，尝试实现我的客户完全分离用户和管理员的愿望，我希望获得req.user和req.admin，但每次都写入req.user。我认为更改LocalStrategy名称会有所帮助，但passport.js似乎忽略了策略名称和模型名称。

非常感谢任何帮助。

P.S。我知道我可以让所有人都在User模型中并根据角色编写一些中间件来保护某些路由，但不幸的是，我不能在这里选择。

Answer 1

不幸的是，你不能用Passport做到这一点。您需要创建快速中间件来处理管理员身份验证。

Answer 2

而且Hya回答护照不适合授权......

您需要使用中间件来设置管理员上下文和管理员角色：

// add this middlewares after your routes...

// set admin context and others things like admin templates
app.use('/admin/*', function adminContext(req, res, next) {
  // set admin context
  req.isAdmin = true;

  next();
});


// then get roles for authenticated user in your passport stategy:
app.use(function getUserRoles(req, res, next) {
  req.userRoleNames = [];

  if (req.isAuthenticated()) {
    req.userRoleNames.push('authenticated');
  } else {
    req.userRoleNames.push('unAuthenticated');
    return next(); // skip role load if dont are authenticated
  }

  // get user roles, you may get roles from DB ...
  // and if are admin add its role
  req.userRoleNames.push('administrator');

  next();

});

// and check roles in admin page
app.get('/admin/admin-page/', function (req, res, next) {
  if (req.userRoleNames.indexOf('administrator') == -1) return res.status(403).send('forbidden');

  console.log('roles:', req.userRoleNames);

  res.status(200).send('Hey you are the administrator!');
});

请参阅we.js核心，了解一个高级角色和权限实施：https://github.com/wejs/we-core

Passport.js多个本地策略和req.user

2 个答案: