我正在创建在线课程申请,我希望只有经过身份验证的用户才能查看课程详情和课程讲座。我正在使用本地护照身份验证策略进行用户身份验证。我在我的路由中添加了isAuthenticated,但是,未经身份验证的用户仍然可以查看视频讲座。 这是我的路线文件。文件名: - courses.server.routes.js
'use strict';
/**
* Module dependencies
*/
var path = require('path'),
mongoose = require('mongoose'),
Course = mongoose.model('Course'),
errorHandler = require(path.resolve('./modules/core/server/controllers/errors.server.controller'));
var passport = require('passport');
/**
* Create an course
*/
exports.create = function (req, res) {
var course = new Course(req.body);
course.user = req.user;
course.save(function (err) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(course);
}
});
};
/**
* Show the current course
*/
exports.read = function (req, res) {
// convert mongoose document to JSON
var course = req.course ? req.course.toJSON() : {};
// Add a custom field to the Course, for determining if the current User is the "owner".
// NOTE: This field is NOT persisted to the database, since it doesn't exist in the Course model.
course.isCurrentUserOwner = !!(req.user && course.user && course.user._id.toString() === req.user._id.toString());
console.log('course value is: ' + course);
console.log('video lecture embed value is: ' + course.courseLecture.lecture_video);
res.json(course);
};
/**
* Update an course
*/
exports.update = function (req, res) {
var course = req.course;
course.title = req.body.title;
course.content = req.body.content;
course.courseLecture.lecture_video = req.body.courseLecture.lecture_video;
console.log('course lecture video url is: ' + req.body.courseLecture.lecture_video);
course.save(function (err) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(course);
}
});
};
/**
* Delete an course
*/
exports.delete = function (req, res) {
var course = req.course;
course.remove(function (err) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(course);
}
});
};
/**
* List of Courses
*/
exports.list = function (req, res) {
Course.find().sort('-created').populate('user', 'displayName').exec(function (err, courses) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(courses);
}
});
};
/**
* Course middleware
*/
exports.courseByID = function (req, res, next, id) {
if (!mongoose.Types.ObjectId.isValid(id)) {
return res.status(400).send({
message: 'Course is invalid'
});
}
Course.findById(id).populate('user', 'displayName').exec(function (err, course) {
if (err) {
return next(err);
} else if (!course) {
return res.status(404).send({
message: 'No course with that identifier has been found'
});
}
req.course = course;
next();
});
};
这是我的路由控制器文件。文件名: - courses.server.controller.js
{{1}}
我无法弄明白,这里出了什么问题。
答案 0 :(得分:1)
来自isAuthenticated
动词的http
函数来自get, post, patch, delete
像:
app.route('/api/courses/:courseId')
.get(isAuthenticated, courses.read)
isAuthenticated
也可以写入另一个文件并在路线中使用