req.session.user missing one of the manually populated fields in policies

[MaheshkumarSundaram]

Hi @neonexus,

I am perplexed by this scenario.

In my webapp adapted from your boilerplate, there is a slight change in the User model where the attribute roles is different:

roles: {
  collection: 'role',
  via: 'user',
  through: 'userrole',
},

Role

// api/models/Role.js
module.exports = {
  primaryKey: 'id',

  attributes: {
      id: {
          type: 'string',
          columnType: 'varchar(36)',
          required: true,
      },

      roleName: {
          type: 'string',
          columnType: 'varchar(36)',
          required: true,
          unique: true,
      },

      description: {
          type: 'string',
      },

      users: {
          collection: 'user',
          via: 'role',
          through: 'userrole',
      },

      permissions: {
          collection: 'permission',
          via: 'role',
          through: 'rolepermission',
      },
  },

  beforeCreate: (role, next) => {
      role.id = sails.helpers.generateUuid();

      return next();
  },
};

UserRole

// api/models/UserRole.js
module.exports = {
  tableName: 'user_role',
  primaryKey: 'id',

  attributes: {
      id: {
          type: 'number',
          autoIncrement: true,
      },

      user: {
          model: 'user',
          required: true,
      },

      role: {
          model: 'role',
          required: true,
      },
  },
};

Permission

// api/models/Permission.js
module.exports = {
  primaryKey: 'id',

  attributes: {
      id: {
          type: 'string',
          columnType: 'varchar(36)',
          required: true,
      },

      permissionName: {
          type: 'string',
          columnType: 'varchar(70)',
          required: true,
          unique: true,
      },

      description: {
          type: 'string',
      },

      roles: {
          collection: 'role',
          via: 'permission',
          through: 'rolepermission',
      },
  },

  beforeCreate: (permission, next) => {
      permission.id = sails.helpers.generateUuid();

      return next();
  },
};

RolePermission

// api/models/UserRole.js
// api/models/RolePermission.js
module.exports = {
  tableName: 'role_permission',
  primaryKey: 'id',

  attributes: {
      id: {
          type: 'number',
          autoIncrement: true,
      },

      role: {
          model: 'role',
          required: true,
      },

      permission: {
          model: 'permission',
          required: true,
      },
  },
};

The above changes because in my usecase, permissions decide the access control instead of roles. roles are just simply groups of permissions. A user can have one or more roles while each role in turn can have one or more permissions. The tables have been separated for normalization.

Hence, there is no explicit attribute permissions in User model. Instead, what I did was manually populate it in login & get-me controllers with a helper:

 foundUser['permissions'] = await sails.helpers.getRolePermissions.with({
    userRoles: foundUser.roles,
});

But in policies, when I access req.session.user, this field permissions is not present. I thought keep-models-safe was stripping it away as its a non-standard field in the model but on debugging, this is not the case either.

I am struggling to grasp where exactly this is getting stripped 😕 or am I looking at the wrong place!!! I suppose I am missing something basic.

Could you please guide me on this 🙏? Any help would be appreciated.

[MaheshkumarSundaram]

Sorry @neonexus, I forgot to set it in isLoggedIn.js 😒😑.